Integer underflow in Linux kernel hwmon driver

1) Integer underflow

EUVDB-ID: #VU97554

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-46759

CWE-ID: CWE-191 - Integer underflow

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the adc128_set_in() and adc128_set_temp() functions in drivers/hwmon/adc128d818.c. A local user can execute arbitrary code.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

External links

http://git.kernel.org/stable/c/05419d0056dcf7088687e561bb583cc06deba777
http://git.kernel.org/stable/c/7645d783df23878342d5d8d22030c3861d2d5426
http://git.kernel.org/stable/c/2a3add62f183459a057336381ef3a896da01ce38
http://git.kernel.org/stable/c/019ef2d396363ecddc46e826153a842f8603799b
http://git.kernel.org/stable/c/f7f5101af5b47a331cdbfa42ba64c507b47dd1fe
http://git.kernel.org/stable/c/6891b11a0c6227ca7ed15786928a07b1c0e4d4af
http://git.kernel.org/stable/c/b0bdb43852bf7f55ba02f0cbf00b4ea7ca897bff
http://git.kernel.org/stable/c/8cad724c8537fe3e0da8004646abc00290adae40

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.