CVE-2024-47663: staging: iio: frequency: ad9834: Validate frequency parameter value
In the Linux kernel, the following vulnerability has been resolved:
staging: iio: frequency: ad9834: Validate frequency parameter value
In ad9834writefrequency() clkgetrate() can return 0. In such case ad9834calcfreqreg() call will lead to division by zero. Checking 'if (fout > (clkfreq / 2))' doesn't protect in case of 'fout' is 0. ad9834writefrequency() is called from ad9834write(), where fout is taken from text buffer, which can contain any value.
Modify parameters checking.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47663?
CVE-2024-47663 has been classified as a high severity vulnerability due to the potential for division by zero that can lead to denial of service.
How do I fix CVE-2024-47663?
To fix CVE-2024-47663, upgrade the Linux kernel to the patched versions such as 5.10.226-1 or 6.1.123-1.
Which Linux kernel versions are affected by CVE-2024-47663?
CVE-2024-47663 affects multiple kernel versions including those prior to 5.10.226 and up to various release candidates of 6.11.
What components are exploited in CVE-2024-47663?
CVE-2024-47663 exploits the ad9834_write_frequency function in the Linux kernel, specifically related to validating frequency parameter values.
Is there a known workaround for CVE-2024-47663?
There is no known workaround for CVE-2024-47663; updating the kernel is the recommended approach.