Potential overflow in iio: adc: ad7124 due to non sequential channel numbers
Summary
GSD-2021-1000564: iio: adc: ad7124: Fix potential overflow due to non sequential channel numbers. Affects Kernel versions >= d7857e4ee1ba69732b16c73b2f2dde83ecd78ee4, < 26da8040eccc6c6b0e415e9a3baf72fd39eb2fdc. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The iio: adc: ad7124 is a driver in the Linux Kernel that provides support for the AD7124 Analog-to-Digital Converter (ADC) chip. This driver enables communication between the ADC chip and the operating system, allowing users to read analog input values. The AD7124 ADC chip is commonly used in various applications, including industrial control systems, medical devices, and scientific instruments. However, a potential vulnerability has been identified in the driver that could lead to an overflow due to non sequential channel numbers.
Vulnerability Detail
The vulnerability in the iio: adc: ad7124 driver arises from a potential overflow when handling non sequential channel numbers. This could occur when the driver receives input from multiple channels that are not in sequential order. The overflow could result in unexpected behavior, such as incorrect readings or system crashes. An attacker could potentially exploit this vulnerability to manipulate the ADC readings or cause a denial-of-service condition. The vulnerability was introduced in Linux Kernel version v5.5 and has been fixed in version v5.12.9.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using non sequential channel numbers when interacting with the iio: adc: ad7124 driver. By ensuring that the channel numbers are in sequential order, the potential overflow can be mitigated. However, this workaround may not be feasible in all scenarios, especially when the ADC chip is used in complex systems with multiple input channels.
Conclusion
The potential overflow vulnerability in the iio: adc: ad7124 driver can be mitigated by updating the Linux Kernel to version v5.12.9 or later. Users can also temporarily avoid using non sequential channel numbers as a workaround. It is important to apply the fix to ensure the security and stability of systems relying on the iio: adc: ad7124 driver. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability could lead to incorrect ADC readings or system crashes, potentially impacting the accuracy and reliability of systems that rely on the iio: adc: ad7124 driver.
No, this vulnerability requires local access to the system in order to manipulate the ADC readings or cause a denial-of-service condition.
There are no known instances of this vulnerability being exploited in the wild. However, it is still important to apply the fix to ensure the security and stability of systems using the iio: adc: ad7124 driver.
No, all systems using the iio: adc: ad7124 driver are potentially vulnerable if non sequential channel numbers are used.
For more details about this vulnerability, including the specific code changes that fix it, you can refer to the vulnerability report on the GSD database: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1000xxx/GSD-2021-1000564.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
