CVE-2024-57953

What it actually does

Integer overflow in tps6594_rtc_set_offset() when multiplying a long 'offset' value by the large TICKS_PER_HOUR constant on 32-bit systems, where long is 32 bits and the result overflows before assignment to s64.

Why it matters to the business

Time offset configuration for affected RTC devices can produce incorrect values or failures on 32-bit Linux deployments, potentially disrupting time-sensitive operations until systems are updated.

How an attack unfolds

An attacker with local access triggers the rtc offset setting path with sufficiently large offset values on a 32-bit system, causing the multiplication to overflow and produce erroneous time adjustments.

How to fix it

Update the Linux kernel to a version containing the fix that changes TICKS_PER_HOUR to long long; apply the patch resolving the overflow in tps6594_rtc_set_offset().

How to confirm the fix worked

Confirm the kernel version includes the rtc tps6594 fix; test tps6594_rtc_set_offset() with large offset values on 32-bit builds and verify no overflow occurs.

Typical attack path

1. Obtain local access on a 32-bit Linux system using the tps6594 RTC driver
2. Invoke tps6594_rtc_set_offset() with an offset value near the upper end of the allowable range
3. Trigger the multiplication tmp = offset * TICKS_PER_HOUR leading to overflow
4. Observe incorrect or failed RTC time offset application

How to detect it

Inspect kernel logs and RTC-related syscalls for anomalies around offset setting; look for unexpected time jumps or failures in tps6594 driver initialization.

What your security team should do

• Prioritize kernel updates on all 32-bit systems using the tps6594 RTC driver
• Review and test RTC offset functionality after patching
• Monitor for any time-related anomalies on affected hardware