CVE-2024-56684: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-56684 affects the Linux kernel's mailbox subsystem, specifically in the MediaTek CMDQ (Command Queue) driver. The vulnerability was discovered and disclosed on December 28, 2024, and involves an incorrect use of sizeof operator in the cmdqgetclocks() function. The issue affects the mtk-cmdq mailbox driver in the Linux kernel (NVD).

The vulnerability stems from a wrong usage of sizeof operator in the cmdqgetclocks() function within the MediaTek CMDQ mailbox driver. Specifically, the code incorrectly used sizeof(cmdq->clocks) instead of sizeof(*cmdq->clocks) when allocating memory with devmkcalloc(). This error was introduced in commit aa1609f571ca which added dynamic allocation of clkbulk_data structure (Kernel Commit).

The incorrect sizeof usage could lead to improper memory allocation for the clock bulk data structure. This could potentially result in memory corruption or system instability in systems using the MediaTek CMDQ mailbox driver.

The issue has been fixed in the Linux kernel through a patch that corrects the sizeof operator usage. The fix has been implemented in multiple kernel versions, including Ubuntu 24.10 (oracular) with kernel version 6.11.0-18.18 (Ubuntu Security). Users should update their systems to the patched versions to mitigate this vulnerability.