CVE-2024-27002: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-27002 is a vulnerability in the Linux kernel's MediaTek clock controller component that was discovered and resolved in 2024. The issue affects Linux kernel versions from 5.2 up to (excluding) 6.1.88, 6.2 up to 6.6.29, 6.7 up to 6.8.8, and various 6.9 release candidates. The vulnerability was identified as an improper locking mechanism (CWE-667) with a CVSS v3.1 base score of 5.5 (Medium) (NVD).

The vulnerability stems from a mutual dependency between mt8183-mfgcfg and genpd during the probing stage, which leads to a deadlock in the clock controller's operation. The issue manifests in a specific call stack where two CPU cores can encounter a deadlock scenario: CPU0 attempts genpd_lock → clk_prepare_lock sequence while CPU1 attempts clk_prepare_lock → genpd_lock sequence. This race condition occurs during the clock controller's initialization phase (Kernel Patch).

The vulnerability can result in a system deadlock, potentially causing a denial of service condition. The issue affects systems using MediaTek clock controllers, particularly verified on MT8183 and MT8192 Chromebooks. The vulnerability requires local access and has been assigned a medium severity rating, indicating significant but contained impact (NVD).

The vulnerability requires local access with low attack complexity and low privileges to exploit. No user interaction is needed for exploitation. The CVSS metrics indicate a local attack vector (AV:L) with low attack complexity (AC:L) and low privileges required (PR:L) (NVD).

The issue has been patched by implementing a runtime PM get operation on controllers during probe. The fix involves doing a pm_runtime_resume_and_get() at the probe function to ensure clk_register() won't acquire the genpd lock. This solution has been applied to all MediaTek clock controller probings to prevent potential regressions (Kernel Patch).