#VU100637 Integer underflow in Linux kernel - CVE-2024-50290

Vulnerability identifier: #VU100637

Vulnerability risk: Low

CVSSv4.0: [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50290

CWE-ID: CWE-191

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the cx24116_read_snr_pct() function in drivers/media/dvb-frontends/cx24116.c. A local user can execute arbitrary code.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
http://git.kernel.org/stable/c/127b9076baeadd734b18ddc8f2cd93b47d5a3ea3
http://git.kernel.org/stable/c/cad97ca8cfd43a78a19b59949f33e3563d369247
http://git.kernel.org/stable/c/828047c70f4716fde4b1316f7b610e97a4e83824
http://git.kernel.org/stable/c/f2b4f277c41db8d548f38f1dd091bbdf6a5acb07
http://git.kernel.org/stable/c/fbefe31e4598cdb0889eee2e74c995b2212efb08
http://git.kernel.org/stable/c/83c152b55d88cbf6fc4685941fcb31333986774d
http://git.kernel.org/stable/c/3a1ed994d9454132354b860321414955da289929
http://git.kernel.org/stable/c/576a307a7650bd544fbb24df801b9b7863b85e2f

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.