CVE-2024-56557

What it actually does

Buffer overflow in tx_buf and ring_xfer arrays inside the ad7923 ADC driver when ad7923_update_scan_mode() is called on 8-channel devices because their sizes were not increased to match the supported channel count.

Why it matters to the business

Local users on affected Linux systems can trigger kernel instability or denial of service; widespread use of the kernel in servers, embedded devices, and cloud instances amplifies operational risk even though exploitation requires local access.

How an attack unfolds

An attacker with local access loads or configures the ad7923 driver for an 8-channel device and invokes a scan-mode update that writes beyond the allocated tx_buf and ring_xfer structures, resulting in memory corruption.

How to fix it

Update the Linux kernel to a version containing commit 00663d3e000c31d0d49ef86a809f5c107c2d09cd or apply the equivalent stable backport; for packaged distributions apply the fixed webkit2gtk or kernel package versions listed for each release.

How to confirm the fix worked

Confirm the running kernel contains the fix commit or is newer than the vulnerable version; inspect the ad7923 driver source for the corrected buffer sizes and recompile or reload the module to verify.

Typical attack path

1. Obtain local shell or user context on a system using the vulnerable ad7923 driver
2. Trigger or wait for a call to ad7923_update_scan_mode() with an 8-channel configuration
3. Cause the driver to perform an out-of-bounds write into tx_buf or ring_xfer
4. Crash the kernel or achieve memory corruption for further exploitation

How to detect it

Review kernel logs for oops or panic messages referencing ad7923_update_scan_mode or buffer overflows; examine audit logs for unusual local processes interacting with the iio subsystem on systems known to use the ad7923 ADC.

What your security team should do

• Apply the kernel patch or distribution update immediately on all systems exposing the ad7923 driver
• Restrict local user access on systems that cannot be patched promptly
• Monitor vendor advisories for additional backports and schedule kernel upgrades during the next maintenance window