Linux Kernel Vulnerability in Mediatek MT8183 Power Management Coprocessor

CVE-2023-53274

What is CVE-2023-53274?

A vulnerability in the Mediatek MT8183 clock driver has been identified, which pertains to the improper management of SSPM related clocks. Previously, these clocks were removed due to perceived low usage, but this action led to issues when transitioned to a new simple-probe mechanism. The mechanism's reliance on all defined clocks in the driver, rather than the highest index, can result in out-of-bounds writes when gaps exist in device tree bindings or driver implementations. Such errors may cause memory corruption, impacting system stability or causing crashes that can remain unnoticed. By reinstating the SSPM related clocks, the driver more accurately adheres to the device tree binding requirements, ensuring reliable power management functionality.

References