#VU101924 Integer underflow in Linux kernel - CVE-2024-53158

Vulnerability identifier: #VU101924

Vulnerability risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53158

CWE-ID: CWE-191

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the geni_se_clk_tbl_get() function in drivers/soc/qcom/qcom-geni-se.c. A local user can execute arbitrary code.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/351bb7f9ecb9d1f09bd7767491a2b8d07f4f1ea4
https://git.kernel.org/stable/c/37cdd4f0c266560b7b924c42361eeae3dc5f0c3e
https://git.kernel.org/stable/c/56eda41dcce0ec4d3418b4f85037bdea181486cc
https://git.kernel.org/stable/c/748557ca7dc94695a6e209eb68fce365da9a3bb3
https://git.kernel.org/stable/c/78261cb08f06c93d362cab5c5034bf5899bc7552
https://git.kernel.org/stable/c/7a3465b79ef0539aa10b310ac3cc35e0ae25b79e
https://git.kernel.org/stable/c/b0a9c6ccaf88c4701787f61ecd2ec0eb014a0677
https://git.kernel.org/stable/c/c24e019ca12d9ec814af04b30a64dd7173fb20fe
https://git.kernel.org/stable/c/f4b7bf5a50f1fa25560f0b66a13563465542861b

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.