CVE-2024-46758

What it actually does

The vulnerability allows an integer underflow in the lm95234 hwmon driver when a large negative value such as -9223372036854775808 is passed through kstrtol followed by DIV_ROUND_CLOSEST without prior clamping, due to improper ordering of operations on limit attributes.

Why it matters to the business

Linux systems using affected Debian 11 kernels may experience instability or crashes when hardware monitoring limit attributes are written with extreme values, increasing operational risk until systems are updated to the fixed package version.

How an attack unfolds

An attacker with local access identifies the lm95234 hwmon sysfs interface and supplies a crafted large negative number to a limit attribute; the un-clamped DIV_ROUND_CLOSEST operation produces an underflow that can be leveraged for denial of service or further kernel impact.

How to fix it

Upgrade the linux package on Debian 11 to version 5.10.226-1 or later to apply the corrected ordering of clamp_val and DIV_ROUND_CLOSEST operations.

How to confirm the fix worked

Confirm the installed linux package version is 5.10.226-1 or newer, then verify that writing extreme negative values to lm95234 limit attributes no longer produces underflow or related kernel errors.

Typical attack path

1. Obtain local user access on the target Linux system
2. Locate lm95234 hwmon limit attribute files under sysfs
3. Write a large negative integer value to a limit attribute
4. Trigger the underflow condition in DIV_ROUND_CLOSEST after kstrtol

How to detect it

Inspect kernel logs and dmesg output for underflow warnings, arithmetic exceptions, or crashes referencing the lm95234 hwmon driver around the time of limit attribute modifications.

What your security team should do

• Immediately schedule upgrade of all Debian 11 systems to linux 5.10.226-1
• Review local access controls and monitoring around sysfs hwmon interfaces
• Test the fix in a staging environment by exercising limit attribute writes with boundary values