CVE-2024-53192

In the Linux kernel, the following vulnerability has been resolved: clk: clk-loongson2: Fix potential buffer overflow in flexible-array member access Flexible-array member `hws` in `struct clk_hw_onecell_data` is annotated with the `counted_by()` attribute. This means that when memory is allocated for this array, the _counter_, which in this case is member `num` in the flexible structure, should be set to the maximum number of elements the flexible array can contain, or fewer. In this case, the total number of elements for the flexible array is determined by variable `clks_num` when allocating heap space via `devm_kzalloc()`, as shown below: 289 struct loongson2_clk_provider *clp; ... 296 for (p = data; p->name; p++) 297 clks_num++; 298 299 clp = devm_kzalloc(dev, struct_size(clp, clk_data.hws, clks_num), 300 GFP_KERNEL); So, `clp->clk_data.num` should be set to `clks_num` or less, and not exceed `clks_num`, as is currently the case. Otherwise, if data is written into `clp->clk_data.hws[clks_num]`, the instrumentation provided by the compiler won't detect the overflow, leading to a memory corruption bug at runtime. Fix this issue by setting `clp->clk_data.num` to `clks_num`.

• CWE-120

• https://git.kernel.org/stable/c/02fb4f0084331ef72c28d0c70fcb15d1bea369ecPatch
• https://git.kernel.org/stable/c/1bf8877150128c3abd9d233886a05f6966fbf0c7Patch
• https://git.kernel.org/stable/c/b96fc194984d0c82de1ca2b4166b35b1298b216cPatch

Published

Dec 27, 2024

Last Modified

Aug 4, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-53186In the Linux kernel, the following vulnerability has been re…7
• CVE-2024-53187In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-53188In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-53189In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-53190In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-53191In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2024-53193In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2024-53194In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2024-53195In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-53196In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-53197In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2024-53198In the Linux kernel, the following vulnerability has been re…5.5