Integer Overflow/Underflow in Hysteresis Calculations in hwmon (lm90)
Summary
GSD-2021-1002827: hwmon: (lm90) Prevent integer overflow/underflow in hysteresis calculations. Affects Kernel versions >= b50aa49638c7e12abf4ecc483f4e928c5cccc1b0, < d105f30bea9104c590a9e5b495cb8a49bdfe405f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The hwmon (Hardware Monitoring) subsystem in the Linux Kernel provides a framework for monitoring various hardware sensors on a system. One of the drivers in this subsystem is lm90, which is responsible for monitoring temperature and voltage sensors on certain hardware devices. The vulnerability identified in this driver relates to integer overflow/underflow in hysteresis calculations. Hysteresis is used to prevent rapid toggling of sensor readings when the value is close to a threshold. However, due to a flaw in the calculation, an attacker could potentially manipulate the hysteresis values to cause unexpected behavior or trigger a denial-of-service condition.
Vulnerability Detail
The vulnerability arises from an integer overflow/underflow issue in the hysteresis calculations performed by the lm90 driver in the hwmon subsystem. When calculating the hysteresis value, an incorrect calculation can lead to an overflow or underflow, resulting in an unexpected value. This could allow an attacker to manipulate the hysteresis values and potentially cause the system to behave in an unintended manner. The impact of this vulnerability could range from minor disruptions to more severe consequences, depending on the specific use case and system configuration. It is important to note that the actual impact and attack plausibility have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can consider disabling or limiting access to the lm90 driver in the hwmon subsystem if it is not essential for their system's functionality. This can be achieved by blacklisting the driver module or configuring the kernel to exclude the driver during the build process. However, it is important to evaluate the impact of this workaround on the system's overall functionality and ensure it does not introduce other vulnerabilities or limitations.
Conclusion
In conclusion, the vulnerability in the hwmon (lm90) driver of the Linux Kernel relates to an integer overflow/underflow issue in hysteresis calculations. It is important to update the kernel to the latest version to mitigate this vulnerability. Users can also consider applying the provided workaround if the lm90 driver is not essential for their system's functionality. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The hwmon subsystem in the Linux Kernel provides a framework for monitoring various hardware sensors on a system. It allows applications and system utilities to access sensor data such as temperature, voltage, and fan speed.
The lm90 driver is a specific driver within the hwmon subsystem that is responsible for monitoring temperature and voltage sensors on certain hardware devices. It interfaces with the LM90 sensor chip to retrieve sensor readings.
Hysteresis is a technique used to prevent rapid toggling of sensor readings when the value is close to a threshold. It introduces a small range around the threshold where the sensor reading needs to move beyond before the state changes. This helps to avoid false triggers and stabilize the system behavior.
The impact of this vulnerability can vary depending on the specific use case and system configuration. It could range from minor disruptions to more severe consequences. An attacker could potentially manipulate the hysteresis values to cause unexpected behavior or trigger a denial-of-service condition.
You can use tools like Vulert (https://vulert.com) to check if your system is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software. You can also visit the Vulert playground at Vulert Scanner to check the vulnerability status without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
