GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-56684 (GCVE-0-2024-56684)

Vulnerability from cvelistv5 – Published: 2024-12-28 09:46 – Updated: 2026-08-05 11:46
VLAI
Title
mailbox: mtk-cmdq: fix wrong use of sizeof in cmdq_get_clocks()
Summary
In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-cmdq: fix wrong use of sizeof in cmdq_get_clocks() It should be size of the struct clk_bulk_data, not data pointer pass to devm_kcalloc().
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: aa1609f571caba0db102c611829d48adf226bb70 , < 31986fad0cfdda8d8893230da04f5eb0774854d9 (git)
Affected: aa1609f571caba0db102c611829d48adf226bb70 , < a9c7cb960fc6e056ebecebd136a127612b15630d (git)
Affected: aa1609f571caba0db102c611829d48adf226bb70 , < 271ee263cc8771982809185007181ca10346fe73 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.11.11 , ≤ 6.11.* (semver)
Unaffected: 6.12.2 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/mailbox/mtk-cmdq-mailbox.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "31986fad0cfdda8d8893230da04f5eb0774854d9",
              "status": "affected",
              "version": "aa1609f571caba0db102c611829d48adf226bb70",
              "versionType": "git"
            },
            {
              "lessThan": "a9c7cb960fc6e056ebecebd136a127612b15630d",
              "status": "affected",
              "version": "aa1609f571caba0db102c611829d48adf226bb70",
              "versionType": "git"
            },
            {
              "lessThan": "271ee263cc8771982809185007181ca10346fe73",
              "status": "affected",
              "version": "aa1609f571caba0db102c611829d48adf226bb70",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/mailbox/mtk-cmdq-mailbox.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.11",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.2",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: mtk-cmdq: fix wrong use of sizeof in cmdq_get_clocks()\n\nIt should be size of the struct clk_bulk_data, not data pointer pass to\ndevm_kcalloc()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The defect is in the MediaTek CMDQ mailbox platform driver\u0027s probe path (`cmdq_probe()` \u2192 `cmdq_get_clocks()`), reachable only on the local system when the driver binds to its DT node; there is no remote or network-facing path into this code.\nAC:L - The undersized `devm_kcalloc()` is exactly half the required size on every supported platform (gce_num 1 or 2, all arm64), so the out-of-bounds write occurs deterministically on every probe with no timing, layout, or state condition to win.\nPR:N - The heap corruption happens unconditionally during driver probe at boot on affected MediaTek SoCs, requiring no privileges or attacker interaction whatsoever; this matches the scoring of the equivalent probe-time allocation-size CVEs (CVE-2025-39869, CVE-2026-43274).\nUI:N - No victim action is needed \u2014 the driver probes automatically at boot on matching hardware, and the out-of-bounds reads recur on every runtime-resume and interrupt without any user involvement.\nS:U - The corruption is confined to kernel heap memory managed by the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The half-sized array is subsequently read out of bounds by `clk_bulk_prepare()`/`clk_bulk_enable()`/`clk_bulk_unprepare()`, pulling a `struct clk *` from adjacent heap and dereferencing it; combined with the overlapping heap write this constitutes memory corruption leverageable for kernel memory disclosure.\nI:H - This is an out-of-bounds heap write of up to 16 bytes of pointer values (`clk_bulk_data.id` and `.clk`) past the end of the devres allocation, corrupting adjacent kernel objects \u2014 an OOB write is scored High.\nA:H - Corrupting the adjacent heap object and later dereferencing an out-of-bounds `struct clk *` in `clk_prepare()`/`clk_enable()` readily produces an oops or panic, and the overflow is flagged as slab-out-of-bounds under KASAN/SLUB redzoning."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:46:03.800Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/31986fad0cfdda8d8893230da04f5eb0774854d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9c7cb960fc6e056ebecebd136a127612b15630d"
        },
        {
          "url": "https://git.kernel.org/stable/c/271ee263cc8771982809185007181ca10346fe73"
        }
      ],
      "title": "mailbox: mtk-cmdq: fix wrong use of sizeof in cmdq_get_clocks()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56684",
    "datePublished": "2024-12-28T09:46:11.932Z",
    "dateReserved": "2024-12-27T15:00:39.846Z",
    "dateUpdated": "2026-08-05T11:46:03.800Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-56684",
      "date": "2026-09-20",
      "epss": "0.00218",
      "percentile": "0.12501"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/mailbox/mtk-cmdq-mailbox.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "31986fad0cfdda8d8893230da04f5eb0774854d9",
                    "status": "affected",
                    "version": "aa1609f571caba0db102c611829d48adf226bb70",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a9c7cb960fc6e056ebecebd136a127612b15630d",
                    "status": "affected",
                    "version": "aa1609f571caba0db102c611829d48adf226bb70",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "271ee263cc8771982809185007181ca10346fe73",
                    "status": "affected",
                    "version": "aa1609f571caba0db102c611829d48adf226bb70",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/mailbox/mtk-cmdq-mailbox.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.11"
                  },
                  {
                    "lessThan": "6.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.11.*",
                    "status": "unaffected",
                    "version": "6.11.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.13",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "07BE5DA1-4C04-4052-9B58-6EDE15469D65",
                    "versionEndExcluding": "6.11.11",
                    "versionStartIncluding": "6.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D8882B1B-2ABC-4838-AC1D-DBDBB5764776",
                    "versionEndExcluding": "6.12.2",
                    "versionStartIncluding": "6.12",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: mtk-cmdq: fix wrong use of sizeof in cmdq_get_clocks()\n\nIt should be size of the struct clk_bulk_data, not data pointer pass to\ndevm_kcalloc()."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: buz\u00f3n: mtk-cmdq: corrige el uso incorrecto de sizeof en cmdq_get_clocks(). Debe ser el tama\u00f1o de la estructura clk_bulk_data, no el puntero de datos pasado a devm_kcalloc()."
          }
        ],
        "id": "CVE-2024-56684",
        "lastModified": "2026-08-04T11:22:21.093",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2024-12-28T10:15:11.267",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/271ee263cc8771982809185007181ca10346fe73"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/31986fad0cfdda8d8893230da04f5eb0774854d9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a9c7cb960fc6e056ebecebd136a127612b15630d"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2025-11-25T08:55:23+00:00",
      "cve": "CVE-2024-56684",
      "id": "CVE-2024-56684",
      "initial_release_date": "2024-12-28T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mailbox: mtk-cmdq: fix wrong use of sizeof in cmdq_get_clocks()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-56684.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.