CVE-2024-57998

What it actually does

Missing index validation in OPP _read_freq() allows out-of-bounds read from opp->rates[] when called via indexed dev_pm_opp_find_freq_* functions, creating a potential buffer overflow condition.

Why it matters to the business

Kernel memory corruption risk on systems using dynamic OPP frequency selection can lead to crashes, denial of service, or local privilege escalation; high ecosystem prevalence of Linux kernel increases exposure for servers, embedded devices, and cloud workloads.

How an attack unfolds

An attacker with local access crafts calls to the indexed OPP lookup functions supplying an out-of-range frequency index, bypassing prior bounds checks and triggering the unsafe read in _read_freq() to corrupt adjacent kernel memory or leak data for further escalation.

How to fix it

Update Linux kernel to commit 774dd6f0f0a61c9c3848e025d7d9eeed1a7ca4cd or later stable releases containing the index check addition; apply vendor backports for supported distributions.

How to confirm the fix worked

Verify kernel source contains assert_clk_index() call in _read_freq() and that indexed find functions pass the frequency index; confirm running kernel version includes the referenced commit via git describe or package changelog.

Typical attack path

1. Obtain local code execution or shell on target system
2. Trigger OPP frequency lookup via indexed API paths (dev_pm_opp_find_freq_exact_indexed, ceil/floor_indexed)
3. Supply crafted index exceeding opp->rates[] table size
4. Exploit resulting out-of-bounds read for memory corruption or information leak
5. Escalate to kernel privileges or cause denial of service

How to detect it

Review kernel logs for unexpected OPP-related warnings or crashes around frequency lookups; correlate with process execution of tools exercising PM_OPP interfaces; examine for post-exploitation artifacts typical of Linux kernel privilege-escalation campaigns.

What your security team should do

• Prioritize kernel updates on all production Linux systems within standard patch windows
• Monitor for similar index-validation issues in other OPP or PM code paths
• Restrict untrusted local code execution where possible until patched