The Linux kernel powers everything from your smartphone to your home router, and behind the scenes, it juggles low-level hardware control with complex code. Recently, a subtle but important bug was caught and fixed: CVE-2024-26967. This issue concerns how frequency tables for Qualcomm Snapdragon 8 Gen 1 (sc828xp) camera clocks are handled. In simple terms, the bug could have let the kernel read past the end of a data table, potentially causing system instability — or worse.

In this post, we’ll break down what happened, show the vulnerable code, and explain what might have happened if it had been exploited.

What is CVE-2024-26967?

CVE-2024-26967 is a Linux kernel vulnerability affecting certain Qualcomm clock drivers, specifically the camera CC (camcc-sc828xp) driver. Due to a missing terminator in frequency table arrays, functions could accidentally read beyond the array’s bounds.

References

- CVE Record at cve.org
- Upstream Linux patch
- Patch mailing list discussion

The Problem: Missing Array Terminator

In Linux drivers for Qualcomm hardware, frequency tables are used to list available clock rates for a component. When the kernel needs to set or verify a clock speed, it looks through this table using helper functions like qcom_find_freq().

To know when the list is done, these tables must end with a special empty entry, like { }. Without this, code looking for the end might run off the end of memory, reading garbage or even causing a crash.

Here’s a simplified version of the affected code before the fix

static const struct freq_tbl ftbl_camcc_sleep_clk_src[] = {
    F(32764, P_BI_TCXO, 1, , ),
    // Missing terminating entry!
};

When qcom_find_freq() walks this array, there’s nothing to tell it where the table ends. So if the function scans past the last entry, it could read unknown memory.

The patch simply added a terminating entry to each table

static const struct freq_tbl ftbl_camcc_sleep_clk_src[] = {
    F(32764, P_BI_TCXO, 1, , ),
    {  }, // Proper end of table
};

This bug is a classic "out-of-bounds read." Here’s what that could mean in real-world terms

- Kernel Crash: By reading past the end, the kernel might see random values, interpret them as valid, and dereference invalid pointers—causing a system crash (kernel panic).
- Data Leak: It's possible (though unlikely with this structure) that the kernel could read confidential data left in memory.
- Information Disclosure: For researchers, this kind of bug might let them learn about kernel heap layout or memory patterns—a step toward more severe exploitation.

In practice, triggering this would require some access to hardware or the ability to call the clock functions in specific, unexpected ways—often from buggy or malicious code running in the kernel itself (e.g., a compromised driver or kernel module).

A Toy Exploit (Hypothetical)

Suppose a user could call an IOCTL or sysfs endpoint that lets them request a bogus clock frequency.

// Kernel pseudo code
struct freq_tbl *f = &freq_tbls[desired_clk];
struct freq_tbl *entry;
for (entry = f; entry->freq != ; entry++) {
    if (entry->freq == wanted_freq) return entry;
}
// What if 'entry' never finds freq==?
// Will run past array, reading unknown memory!

A malicious actor might be able to request a frequency not present in the table, causing the search to read into neighboring memory — possibly causing a crash, information leak, or opening doors to other attacks (though with real-world barriers).

Devices using Qualcomm Snapdragon 8cx Gen 3 (sc828xp) with camera support in Linux

- Any Linux distros with this kernel and driver built in (rare for desktops, more likely in experimental ARM laptops or dev boards)

If in doubt, and you’re building kernels for this hardware, update to a version with the fix merged (post mainline commit c69fbd57414b).

Final Thoughts

CVE-2024-26967 is a reminder that little errors—like a missing { }—can have big effects in kernel code. While this bug required kernel-level access to exploit and is unlikely to be used as a remote attack, any out-of-bounds read in such low-level code is a security concern.

If you work with embedded Linux for Qualcomm platforms, make sure your code is up-to-date. Even tiny patches matter!

Original resources for further reading

- Linux commit "clk: qcom: camcc-sc828xp: fix terminating of frequency table arrays"
- CVE-2024-26967 entry
- QCOM clock driver reference

Timeline

Published on: 05/01/2024 06:15:13 UTC
Last modified on: 12/23/2024 13:53:27 UTC