linux-cve-announce - CVE-2024-50181: clk: imx: Remove CLK_SET_PARENT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024110833-CVE-2024-50181-e1da@gregkh>
Date: Fri,  8 Nov 2024 06:38:34 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-50181: clk: imx: Remove CLK_SET_PARENT_GATE for DRAM mux for i.MX7D

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

clk: imx: Remove CLK_SET_PARENT_GATE for DRAM mux for i.MX7D

For i.MX7D DRAM related mux clock, the clock source change should ONLY
be done done in low level asm code without accessing DRAM, and then
calling clk API to sync the HW clock status with clk tree, it should never
touch real clock source switch via clk API, so CLK_SET_PARENT_GATE flag
should NOT be added, otherwise, DRAM's clock parent will be disabled when
DRAM is active, and system will hang.

The Linux kernel CVE team has assigned CVE-2024-50181 to this issue.


Affected and fixed versions
===========================

	Fixed in 5.10.227 with commit b677b94a9193
	Fixed in 5.15.168 with commit d18dc8e14b9c
	Fixed in 6.1.113 with commit 11ceb17e6f07
	Fixed in 6.6.57 with commit 339273a9ddfe
	Fixed in 6.11.4 with commit 94f6cdc837e3
	Fixed in 6.12-rc1 with commit a54c441b46a0

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-50181
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/clk/imx/clk-imx7d.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b677b94a9193ec7b6607bd1255172ae59174a382
	https://git.kernel.org/stable/c/d18dc8e14b9c794f58dae1577ccb2ab84a4a1b11
	https://git.kernel.org/stable/c/11ceb17e6f07cc30410f3a6276cddda248a9b863
	https://git.kernel.org/stable/c/339273a9ddfe7632b717c2e13e81cbd5d383e1ff
	https://git.kernel.org/stable/c/94f6cdc837e38371324cee97dfd2ef1a99a82c98
	https://git.kernel.org/stable/c/a54c441b46a0745683c2eef5a359d22856d27323