CVE-2024-39462

Linux Kernel vulnerability

9.8 CRITICALEPSS 0.77%

Published25 Jun 2024

Description

In the Linux kernel, the following vulnerability has been resolved: clk: bcm: dvp: Assign ->num before accessing ->hws Commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with __counted_by") annotated the hws member of 'struct clk_hw_onecell_data' with __counted_by, which informs the bounds sanitizer about the number of elements in hws, so that it can warn when hws is accessed out of bounds. As noted in that change, the __counted_by member must be initialized with the number of elements before the first array access happens, otherwise there will be a warning from each access prior to the initialization because the number of elements is zero. This occurs in clk_dvp_probe() due to ->num being assigned after ->hws has been accessed: UBSAN: array-index-out-of-bounds in drivers/clk/bcm/clk-bcm2711-dvp.c:59:2 index 0 is out of range for type 'struct clk_hw *[] __counted_by(num)' (aka 'struct clk_hw *[]') Move the ->num initialization to before the first access of ->hws, which clears up the warning.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Linux Kernel≥ 6.6 < 6.6.34 · ≥ 6.7 < 6.9.5

Remediation

Fixed in

Linux Kernel≥ 6.6.34

Frequently asked

Is CVE-2024-39462 being actively exploited?

CVE-2024-39462 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.77%.

How severe is CVE-2024-39462?

CVE-2024-39462 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 0.77% probability of exploitation.

Which products are affected by CVE-2024-39462?

Affected products include Linux Kernel.

How do I fix CVE-2024-39462?

Upgrade affected software to a fixed version, for example Linux Kernel 6.6.34 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2024-39462 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.