CVE-2024-50233: staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg()
In the Linux kernel, the following vulnerability has been resolved:
staging: iio: frequency: ad9832: fix division by zero in ad9832calcfreqreg()
In the ad9832writefrequency() function, clkgetrate() might return 0. This can lead to a division by zero when calling ad9832calcfreqreg(). The check if (fout > (clkgetrate(st->mclk) / 2)) does not protect against the case when fout is 0. The ad9832writefrequency() function is called from ad9832write(), and fout is derived from a text buffer, which can contain any value.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.15.173.1-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.64.2-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50233?
CVE-2024-50233 has a medium severity rating due to the potential for a division by zero error in the Linux kernel.
How do I fix CVE-2024-50233?
To fix CVE-2024-50233, update your Linux kernel to a version that addresses the division by zero vulnerability.
Which versions of the Linux kernel are affected by CVE-2024-50233?
CVE-2024-50233 affects multiple versions of the Linux kernel ranging from 2.6.39 to 6.12-rc5.
What components are impacted by CVE-2024-50233?
CVE-2024-50233 impacts the iio: frequency: ad9832 component of the Linux kernel.
Is CVE-2024-50233 exploitable remotely?
CVE-2024-50233 is not considered remotely exploitable since the vulnerability requires local access to trigger the division by zero.