Integer underflow in Linux kernel hwmon driver

1) Integer underflow

EUVDB-ID: #VU97553

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-46758

CWE-ID: CWE-191 - Integer underflow

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the set_tcrit2(), set_tcrit1(), set_tcrit1_hyst() and set_offset() functions in drivers/hwmon/lm95234.c. A local user can execute arbitrary code.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

External links

http://git.kernel.org/stable/c/93f0f5721d0cca45dac50af1ae6f9a9826c699fd
http://git.kernel.org/stable/c/438453dfbbdcf4be26891492644aa3ecbb42c336
http://git.kernel.org/stable/c/59c1fb9874a01c9abc49a0a32f192a7e7b4e2650
http://git.kernel.org/stable/c/0fc27747633aa419f9af40e7bdfa00d2ec94ea81
http://git.kernel.org/stable/c/da765bebd90e1b92bdbc3c6a27a3f3cc81529ab6
http://git.kernel.org/stable/c/46e4fd338d5bdbaf60e41cda625b24949d2af201
http://git.kernel.org/stable/c/16f42953231be1e7be77bc24005270d9e0d9d2ee
http://git.kernel.org/stable/c/af64e3e1537896337405f880c1e9ac1f8c0c6198

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.