linux-cve-announce - CVE-2024-46756: hwmon: (w83627ehf) Fix underflows seen when writing limit attributes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024091840-CVE-2024-46756-2ca6@gregkh>
Date: Wed, 18 Sep 2024 09:16:51 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-46756: hwmon: (w83627ehf) Fix underflows seen when writing limit attributes

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (w83627ehf) Fix underflows seen when writing limit attributes

DIV_ROUND_CLOSEST() after kstrtol() results in an underflow if a large
negative number such as -9223372036854775808 is provided by the user.
Fix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations.

The Linux kernel CVE team has assigned CVE-2024-46756 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.19.322 with commit 93cf73a7bfdc
	Fixed in 5.4.284 with commit 77ab0fd231c4
	Fixed in 5.10.226 with commit 56cfdeb2c772
	Fixed in 5.15.167 with commit cc4be794c8d8
	Fixed in 6.1.110 with commit d92f0baf99a7
	Fixed in 6.6.51 with commit 8fecb75bff1b
	Fixed in 6.10.10 with commit 26825b62bd1b
	Fixed in 6.11 with commit 5c1de37969b7

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-46756
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/hwmon/w83627ehf.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/93cf73a7bfdce683bde3a7bb65f270d3bd24497b
	https://git.kernel.org/stable/c/77ab0fd231c4ca873ec6908e761970360acc6df2
	https://git.kernel.org/stable/c/56cfdeb2c77291f0b5e4592731adfb6ca8fc7c24
	https://git.kernel.org/stable/c/cc4be794c8d8c253770103e097ab9dbdb5f99ae1
	https://git.kernel.org/stable/c/d92f0baf99a7e327dcceab37cce57c38aab1f691
	https://git.kernel.org/stable/c/8fecb75bff1b7d87a071c32a37aa0700f2be379d
	https://git.kernel.org/stable/c/26825b62bd1bd3e53b4f44e0745cb516d5186343
	https://git.kernel.org/stable/c/5c1de37969b7bc0abcb20b86e91e70caebbd4f89