Integer Underflow Affecting kernel-livepatch-4.14.355-271.569 package, versions <0:1.0-0.amzn2
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-AMZN2-KERNELLIVEPATCH414355271569-8382979
- published 16 Nov 2024
- disclosed 18 Sep 2024
Introduced: 18 Sep 2024
CVE-2024-46757 Open this link in a new tabHow to fix?
Upgrade Amazon-Linux:2 kernel-livepatch-4.14.355-271.569 to version 0:1.0-0.amzn2 or higher.
This issue was patched in ALAS2-2024-2696.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-livepatch-4.14.355-271.569 package and not the kernel-livepatch-4.14.355-271.569 package as distributed by Amazon-Linux.
See How to fix? for Amazon-Linux:2 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
DIV_ROUND_CLOSEST() after kstrtol() results in an underflow if a large negative number such as -9223372036854775808 is provided by the user. Fix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations.
References
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-46757
- https://git.kernel.org/stable/c/02bb3b4c7d5695ff4be01e0f55676bba49df435e
- https://git.kernel.org/stable/c/0403e10bf0824bf0ec2bb135d4cf1c0cc3bf4bf0
- https://git.kernel.org/stable/c/0c23e18cef20b989a9fd7cb0a745e1259b969159
- https://git.kernel.org/stable/c/298a55f11edd811f2189b74eb8f53dee34d4f14c
- https://git.kernel.org/stable/c/2f695544084a559f181cafdfd3f864c5ff9dd1db
- https://git.kernel.org/stable/c/8a1e958e26640ce015abdbb75c8896301b9bf398
- https://git.kernel.org/stable/c/996221b030995cc5f5baa4a642201d64b62a17cd
- https://git.kernel.org/stable/c/d6035c55fa9afefc23f85f57eff1d4a1d82c5b10