CVE-2024-50233

What it actually does

Division by zero in ad9832_calc_freqreg() when clk_get_rate() returns 0 or when fout derived from user text buffer is 0, bypassing the existing fout > (clk_get_rate / 2) check and causing a kernel crash.

Why it matters to the business

Local denial of service on systems using the ad9832 driver; potential loss of availability for frequency synthesis hardware or embedded devices, with low urgency given no known exploitation and stable low EPSS.

How an attack unfolds

An attacker with local access supplies a zero or invalid frequency value via the ad9832_write() interface; the missing validation allows the division by zero to occur during frequency register calculation, crashing the kernel.

How to fix it

Update to a kernel containing the fix for CVE-2024-50233; ensure ad9832_write_frequency() validates clk_get_rate() result and fout value before division.

How to confirm the fix worked

Confirm the patch is applied by inspecting the ad9832 driver source for added zero checks on clk_get_rate() and fout; test write operations with fout=0 and verify no crash occurs.

Typical attack path

1. Obtain local user or process access on an affected Linux system
2. Write a zero or malformed frequency value to the ad9832 device attribute
3. Trigger ad9832_write_frequency() which calls ad9832_calc_freqreg() without proper zero checks
4. Cause division by zero and resulting kernel panic or oops

How to detect it

Review kernel logs for division-by-zero faults or oops in the ad9832 driver; inspect process activity writing to frequency sysfs attributes immediately prior to crashes.

What your security team should do

• Apply the upstream kernel fix or distribution update containing the division-by-zero guard
• Restrict unprivileged local access to the ad9832 device if hardware is present
• Monitor for kernel oops or panic logs related to ad9832_calc_freqreg