Homepage

CVE-2024-53193 Affecting kernel-uek-modules-extra-netfilter package, versions <0:6.12.0-101.33.4.3.el9uek

Severity

 Recommended
high

Based on Oracle Linux security rating.

Threat Intelligence

EPSS
0.04% (13th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ORACLE9-KERNELUEKMODULESEXTRANETFILTER-10789193
  • published19 Jul 2025
  • disclosed27 Dec 2024
Report a new vulnerability Found a mistake?

Introduced: 27 Dec 2024

CVE-2024-53193  (opens in a new tab)

How to fix?

Upgrade Oracle:9 kernel-uek-modules-extra-netfilter to version 0:6.12.0-101.33.4.3.el9uek or higher.
This issue was patched in ELSA-2025-20480.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-uek-modules-extra-netfilter package and not the kernel-uek-modules-extra-netfilter package as distributed by Oracle. See How to fix? for Oracle:9 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

clk: clk-loongson2: Fix memory corruption bug in struct loongson2_clk_provider

Some heap space is allocated for the flexible structure struct clk_hw_onecell_data and its flexible-array member hws through the composite structure struct loongson2_clk_provider in function loongson2_clk_probe(), as shown below:

289 struct loongson2_clk_provider *clp; ... 296 for (p = data; p->name; p++) 297 clks_num++; 298 299 clp = devm_kzalloc(dev, struct_size(clp, clk_data.hws, clks_num), 300 GFP_KERNEL);

Then some data is written into the flexible array:

350 clp->clk_data.hws[p->id] = hw;

This corrupts clk_lock, which is the spinlock variable immediately following the clk_data member in struct loongson2_clk_provider:

struct loongson2_clk_provider { void __iomem *base; struct device dev; struct clk_hw_onecell_data clk_data; spinlock_t clk_lock; / protect access to DIV registers */ };

The problem is that the flexible structure is currently placed in the middle of struct loongson2_clk_provider instead of at the end.

Fix this by moving struct clk_hw_onecell_data clk_data; to the end of struct loongson2_clk_provider. Also, add a code comment to help prevent this from happening again in case new members are added to the structure in the future.

This change also fixes the following -Wflex-array-member-not-at-end warning:

drivers/clk/clk-loongson2.c:32:36: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]

CVSS Base Scores

version 3.1