CVE-2024-56567

What it actually does

Division by zero in ad7780_write_raw() when val2==0 is passed to DIV_ROUND_CLOSEST() via the IIO write_raw handler.

Why it matters to the business

Kernel panic or denial of service on systems exposing the AD7780 ADC through the industrial I/O subsystem, interrupting sensor-dependent workloads.

How an attack unfolds

An attacker with write access to the IIO sysfs or character device interface supplies a zero value for val2 while invoking the write_raw operation, triggering an unhandled division-by-zero exception in the kernel driver.

How to fix it

Upgrade the Linux kernel to a version containing commit 18fb33df1de83a014d7f784089f9b124facc157f or apply the vendor-supplied patch that validates val2 before the DIV_ROUND_CLOSEST call.

How to confirm the fix worked

Confirm kernel source contains the fix commit, then exercise ad7780_write_raw() with val2=0 and verify no division-by-zero fault occurs.

Typical attack path

1. Locate host exposing ad7780 IIO device
2. Obtain write access to /sys/bus/iio/devices/*/in_voltage*_raw or equivalent
3. Invoke write_raw with val2 set to zero
4. Trigger kernel exception and crash

How to detect it

Search kernel logs for oops or panic messages referencing ad7780_write_raw and division by zero; inspect IIO device write activity preceding the crash.

• ad7780_write_raw
• DIV_ROUND_CLOSEST
• division by zero

What your security team should do

• Apply the referenced kernel commit immediately on all affected systems
• Restrict unprivileged access to IIO device nodes until patched
• Monitor EPSS trend and kernel mailing list for related driver fixes