CVE-2024-42223: media: dvb-frontends: tda10048: Fix integer overflow
In the Linux kernel, the following vulnerability has been resolved:
media: dvb-frontends: tda10048: Fix integer overflow
state->xtalhz can be up to 16M, so it can overflow a 32 bit integer when multiplied by pllmfactor.
Create a new 64 bit variable to hold the calculations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.98-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.9.9-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
Create a new 64 bit variable to hold the calculations involving state->xtal_hz multiplied by pll_mfactor, preventing integer overflow.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42223?
CVE-2024-42223 is a high severity vulnerability due to the potential for integer overflow in the Linux kernel.
How do I fix CVE-2024-42223?
To fix CVE-2024-42223, update to the patched versions of the Linux kernel, such as 5.10.223-1 or 6.1.123-1.
Which versions of the Linux kernel are affected by CVE-2024-42223?
CVE-2024-42223 affects multiple versions of the Linux kernel from 4.x up to certain versions in the 6.x series.
Is there a workaround for CVE-2024-42223?
There are no known workarounds for CVE-2024-42223; the best action is to apply the relevant kernel updates.
What components are impacted by CVE-2024-42223?
CVE-2024-42223 primarily impacts the media subsystem, particularly the dvb-frontends related to the tda10048 device.