Bug 2333984 (CVE-2024-53159)

Summary: CVE-2024-53159 kernel: hwmon: (nct6775-core) Fix overflows seen when writing limit attributes
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: dfreiber, drow, jburrell, vkumar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
[REJECTED CVE] A vulnerability was identified in the Linux kernel's nct6775-core hardware monitoring (hwmon) driver, where writing large values (e.g., 18446744073709551615) to limit attributes could cause an overflow due to improper ordering of DIV_ROUND_CLOSEST() and clamp_val(). This flaw allowed unintended behavior when setting sensor limits, potentially leading to incorrect readings or improper thermal and voltage regulation. Exploitation required local user privileges to write to the relevant sysfs attributes.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2024-12-24 12:02:17 UTC 
In the Linux kernel, the following vulnerability has been resolved:

hwmon: (nct6775-core) Fix overflows seen when writing limit attributes

DIV_ROUND_CLOSEST() after kstrtoul() results in an overflow if a large
number such as 18446744073709551615 is provided by the user.
Fix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations.
Comment 1 Avinash Hanwate 2024-12-24 12:28:08 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024122430-CVE-2024-53159-f910@gregkh/T
Comment 2 TEJ RATHI 2025-02-20 11:28:37 UTC 
This CVE has been rejected upstream:
https://lore.kernel.org/linux-cve-announce/2025010928-REJECTED-a508@gregkh/