CVE-2024-56684

What it actually does

Incorrect sizeof argument passed to devm_kcalloc in cmdq_get_clocks allocates only the size of a pointer instead of struct clk_bulk_data, resulting in under-allocation and subsequent memory corruption when the clock array is populated and used.

Why it matters to the business

Kernel instability, crashes, or denial of service on affected systems; low EPSS and no KEV status reduce immediate ransomware urgency but the 653-day exposure window and listed threat actor campaigns increase long-term operational risk for Linux environments.

How an attack unfolds

An attacker triggers cmdq_get_clocks on a vulnerable MediaTek command queue mailbox instance; the undersized allocation leads to out-of-bounds writes when clock data is stored, enabling memory corruption that can be leveraged for privilege escalation or system compromise in campaigns by espionage and financially motivated actors.

How to fix it

Apply the upstream fix correcting the sizeof argument to sizeof(struct clk_bulk_data). For listed affected products update imagemagick (Ubuntu:14.04:LTS) to 8:6.7.7.10-6ubuntu3.11 and imagemagick (Ubuntu:16.04:LTS) to 8:6.8.9.9-7ubuntu5.11.

How to confirm the fix worked

Confirm the sizeof correction appears in cmdq_get_clocks, rebuild and boot the updated kernel, then exercise mailbox clock acquisition paths while monitoring for allocation-related warnings or panics.

Typical attack path

1. Locate systems exposing the mtk-cmdq mailbox driver
2. Trigger clock bulk data allocation via mailbox operations
3. Exploit resulting memory corruption for out-of-bounds access
4. Escalate privileges or cause denial of service

How to detect it

Review kernel logs for oops or warning messages referencing cmdq_get_clocks or mtk-cmdq allocation failures; correlate with process activity that exercises the mailbox driver in environments known to be targeted by the listed threat actors.

What your security team should do

• Prioritize kernel updates on all MediaTek-based systems within the next 30 days given the long publication window
• Audit custom drivers calling similar devm_kcalloc patterns for identical sizeof mistakes
• Enable kernel memory debugging options (KASAN) in test environments to surface similar issues