CVE-2021-47098

What it actually does

Integer overflow or underflow in hysteresis temperature calculations within the lm90 hwmon driver when an attacker attempts to set the hysteresis value to MAX_LONG while the critical temperature limit is negative.

Why it matters to the business

Local attackers on affected Linux systems could trigger memory corruption or crashes, leading to denial of service or potential privilege escalation; urgency is low given the absence of known exploitation and stable EPSS.

How an attack unfolds

An attacker with local access writes extreme temperature limit values through sysfs interfaces to the lm90 driver, causing arithmetic overflow or underflow during hysteresis computation that may corrupt kernel memory or crash the system.

How to fix it

Upgrade affected packages to the fixed versions: binutils (Red Hat:rhel_aus:7.3::server) to 0:2.25.1-22.base.el7_3.3 and corresponding updates for binutils-debuginfo and binutils-devel; apply the kernel patch that introduces clamp_val() for hysteresis values.

How to confirm the fix worked

Confirm the lm90 driver source contains the clamp_val() guard on hysteresis temperature assignment and test by attempting to set the extreme values post-update to verify they are clamped without overflow.

Typical attack path

1. Obtain local user access on target system
2. Identify lm90 hwmon device via sysfs
3. Write MAX_LONG to hysteresis while setting negative critical temperature limit
4. Trigger overflow during limit enforcement to corrupt state or crash

How to detect it

Review kernel logs and audit trails for unusual writes to lm90 sysfs temperature attributes; look for processes attempting to set temperature limits near MAX_LONG or negative critical values.

What your security team should do

• Prioritize patching systems exposing hwmon interfaces to untrusted local users
• Monitor EPSS and KEV status for any future rise in exploit activity
• Restrict write access to hwmon sysfs entries via file permissions or SELinux policies where possible