Vulnerability · Published Dec 27, 2024 · Assigned by Linux

CVE-2024-53223clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs

Medium 5.5

In plain English

A medium-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.2%top 87.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs Base clocks are the first in being probed and are real dependencies of the rest of fixed, factor and peripheral clocks. For old ralink SoCs RT2880, RT305x and RT3883 'xtal' must be defined first since in any other case, when fixed clocks are probed they are delayed until 'xtal' is probed so the following warning appears: WARNING: CPU: 0 PID: 0 at drivers/clk/ralink/clk-mtmips.c:499 rt3883_bus_recalc_rate+0x98/0x138 Modules linked in: CPU: 0 PID: 0 Comm: swapper Not tainted 6.6.43 #0 Stack : 805e58d0 00000000 00000004 8004f950 00000000 00000004 00000000 00000000 80669c54 80830000 80700000 805ae570 80670068 00000001 80669bf8 00000000 00000000 00000000 805ae570 80669b38 00000020 804db7dc 00000000 00000000 203a6d6d 80669b78 80669e48 70617773 00000000 805ae570 00000000 00000009 00000000 00000001 00000004 00000001 00000000 00000000 83fe43b0 00000000 ... Call Trace: [<800065d0>] show_stack+0x64/0xf4 [<804bca14>] dump_stack_lvl+0x38/0x60 [<800218ac>] __warn+0x94/0xe4 [<8002195c>] warn_slowpath_fmt+0x60/0x94 [<80259ff8>] rt3883_bus_recalc_rate+0x98/0x138 [<80254530>] __clk_register+0x568/0x688 [<80254838>] of_clk_hw_register+0x18/0x2c [<8070b910>] rt2880_clk_of_clk_init_driver+0x18c/0x594 [<8070b628>] of_clk_init+0x1c0/0x23c [<806fc448>] plat_time_init+0x58/0x18c [<806fdaf0>] time_init+0x10/0x6c [<806f9bc4>] start_kernel+0x458/0x67c ---[ end trace 0000000000000000 ]--- When this driver was mainlined we could not find any active users of old ralink SoCs so we cannot perform any real tests for them. Now, one user of a Belkin f9k1109 version 1 device which uses RT3883 SoC appeared and reported some issues in openWRT: - https://github.com/openwrt/openwrt/issues/16054 Thus, define a 'rt2880_xtal_recalc_rate()' just returning the expected frequency 40Mhz and use it along the old ralink SoCs to have a correct boot trace with no warnings and a working clock plan from the beggining.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13linux6.12.3-1DEBIAN-CVE-2024-53223
Debian:14linux6.12.3-1DEBIAN-CVE-2024-53223
Ubuntu:24.04:LTSlinux6.8.0-58.60UBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-53223
Ubuntu:24.04:LTSlinux-aws6.8.0-1027.29UBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1027.29~22.04.1UBUNTU-CVE-2024-53223
Ubuntu:24.04:LTSlinux-azure6.8.0-1027.32UBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-53223
Ubuntu:24.04:LTSlinux-azure-6.116.11.0-1012.12~24.04.1UBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1027.32~22.04.1UBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-53223
Ubuntu:24.04:LTSlinux-azure-nvidia6.8.0-1014.15UBUNTU-CVE-2024-53223
Ubuntu:24.04:LTSlinux-gcp6.8.0-1028.30UBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-53223
Ubuntu:24.04:LTSlinux-gcp-6.116.11.0-1011.11~24.04.1UBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1028.30~22.04.1UBUNTU-CVE-2024-53223
Ubuntu:24.04:LTSlinux-gke6.8.0-1023.27UBUNTU-CVE-2024-53223
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1010.12UBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-58.60~22.04.1UBUNTU-CVE-2024-53223
Ubuntu:24.04:LTSlinux-ibm6.8.0-1024.24UBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-ibm-6.86.8.0-1024.24~22.04.1UBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2024-53223
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-58.60.1UBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-58.60.1~22.04.1UBUNTU-CVE-2024-53223
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1026.29UBUNTU-CVE-2024-53223
Ubuntu:24.04:LTSlinux-nvidia-6.116.11.0-1007.7UBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1026.29~22.04.1UBUNTU-CVE-2024-53223
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1026.29.1UBUNTU-CVE-2024-53223
Ubuntu:24.04:LTSlinux-nvidia-tegra6.8.0-1008.8UBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-53223
Ubuntu:24.04:LTSlinux-oem-6.116.11.0-1015.15UBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2024-53223
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1026.26UBUNTU-CVE-2024-53223
Ubuntu:24.04:LTSlinux-oracle6.8.0-1024.25UBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1024.25~22.04.1UBUNTU-CVE-2024-53223
Ubuntu:24.04:LTSlinux-raspi6.8.0-1028.32UBUNTU-CVE-2024-53223
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-53223
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-53223
Ubuntu:24.04:LTSlinux-riscv6.8.0-58.60.1UBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-58.60.1~22.04.1UBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-53223
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2024-53223
Ubuntu:24.04:LTSlinux-xilinx6.8.0-1017.18UBUNTU-CVE-2024-53223

Affected products (as reported)

VendorProductVersions
Linux Linux 6f3b15586eef736831abe6a14f2a6906bc0dc074 – before fbb13732c6ffa9d58cedafabcd5ce8fd7ef8ae5a6f3b15586eef736831abe6a14f2a6906bc0dc074 – before fe09d609f2304c7775789090e3f006d7868521486f3b15586eef736831abe6a14f2a6906bc0dc074 – before e29306c0e1ae4b434db32c90705844c77f701be56f3b15586eef736831abe6a14f2a6906bc0dc074 – before d34db686a3d74bd564bfce2ada15011c556269fc
Linux Linux 6.5

References