CVE-2021-47172

What it actually does

Improper validation of channel numbering in the ad7124 ADC driver allows non-sequential channel assignments (not starting at 0 with no gaps) to overflow allocated storage buffers.

Why it matters to the business

Systems using affected Linux kernels with this ADC hardware risk kernel instability, crashes, or memory corruption that can disrupt industrial or embedded device operation.

How an attack unfolds

An attacker with ability to influence device tree configuration or channel setup provides non-contiguous channel numbers; the driver then writes beyond allocated storage when processing channels, leading to memory corruption.

How to fix it

Update the Linux kernel to a version containing the fix for this channel numbering validation; rebuild and deploy any custom kernels or distributions incorporating the corrected ad7124 driver logic.

How to confirm the fix worked

Confirm kernel source contains the sequential channel check (starting at 0 with no holes) in drivers/iio/adc/ad7124.c; test device initialization with valid contiguous channels and verify no overflow occurs under QEMU or hardware.

Typical attack path

1. Gain local access or control over device tree/sysfs configuration on target system
2. Configure ad7124 channels with numbering that skips values or does not start at zero
3. Trigger driver initialization or channel scanning to cause out-of-bounds write
4. Leverage resulting memory corruption for denial of service or privilege escalation

How to detect it

Review kernel logs for ad7124-related oops, panic, or buffer overflow warnings during module load or channel configuration; inspect device tree blobs for non-sequential channel properties.

What your security team should do

• Prioritize kernel updates on any systems exposing the ad7124 driver
• Audit device tree files for ad7124 channel definitions to ensure contiguous numbering from 0
• Monitor for kernel oops or panic logs related to ad7124 during driver load