CVE-2024-46757

What it actually does

Underflow occurs in nct6775-core hwmon driver when DIV_ROUND_CLOSEST() processes a large negative value returned by kstrtol() on limit attribute writes; reordering clamp_val() before the division prevents the wrap-around.

Why it matters to the business

Unpatched systems risk kernel instability or crashes when monitoring hardware limits are written with crafted negative values, potentially disrupting server availability and requiring emergency reboots in production Linux environments.

How an attack unfolds

An attacker with local write access to hwmon sysfs limit attributes supplies an extremely large negative integer; the flawed ordering of conversion and clamping produces an underflow that can corrupt kernel state or trigger a crash.

How to fix it

Upgrade linux package on Debian 11 to version 5.10.226-1 or later; rebuild and reboot into the fixed kernel; verify with uname -r after installation.

How to confirm the fix worked

Confirm installed kernel version is at least 5.10.226-1, test writing both large negative and positive values to hwmon limit attributes without underflow, and monitor dmesg for related warnings.

Typical attack path

1. Obtain local shell or process on affected Debian 11 system
2. Locate nct6775 hwmon device under /sys/class/hwmon
3. Write large negative value to a limit attribute such as temp1_max
4. Trigger underflow via DIV_ROUND_CLOSEST after kstrtol
5. Observe kernel panic or memory corruption

How to detect it

Search kernel logs and audit trails for underflow warnings or crashes in nct6775-core around hwmon attribute writes; correlate with unusual negative values in sysfs writes if extended logging is enabled.

What your security team should do

• Prioritize patching Debian 11 systems to linux 5.10.226-1 within maintenance windows
• Restrict unprivileged write access to hwmon sysfs entries via file permissions or SELinux policies
• Add kernel version checks to vulnerability scanners and asset inventories
• Review recent hwmon attribute writes in audit logs for anomalous negative values