CVE-2021-47098 (GCVE-0-2021-47098)

Vulnerability from cvelistv5 – Published: 2024-03-04 18:10 – Updated: 2026-05-11 13:48
VLAI?
Title
hwmon: (lm90) Prevent integer overflow/underflow in hysteresis calculations
Summary
In the Linux kernel, the following vulnerability has been resolved: hwmon: (lm90) Prevent integer overflow/underflow in hysteresis calculations Commit b50aa49638c7 ("hwmon: (lm90) Prevent integer underflows of temperature calculations") addressed a number of underflow situations when writing temperature limits. However, it missed one situation, seen when an attempt is made to set the hysteresis value to MAX_LONG and the critical temperature limit is negative. Use clamp_val() when setting the hysteresis temperature to ensure that the provided value can never overflow or underflow.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: b50aa49638c7e12abf4ecc483f4e928c5cccc1b0 , < d105f30bea9104c590a9e5b495cb8a49bdfe405f (git)
Affected: b50aa49638c7e12abf4ecc483f4e928c5cccc1b0 , < 55840b9eae5367b5d5b29619dc2fb7e4596dba46 (git)
Create a notification for this product.
Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 5.15.12 , ≤ 5.15.* (semver)
Unaffected: 5.16 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:24:39.865Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d105f30bea9104c590a9e5b495cb8a49bdfe405f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/55840b9eae5367b5d5b29619dc2fb7e4596dba46"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47098",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:56:08.048392Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:33.427Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwmon/lm90.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d105f30bea9104c590a9e5b495cb8a49bdfe405f",
              "status": "affected",
              "version": "b50aa49638c7e12abf4ecc483f4e928c5cccc1b0",
              "versionType": "git"
            },
            {
              "lessThan": "55840b9eae5367b5d5b29619dc2fb7e4596dba46",
              "status": "affected",
              "version": "b50aa49638c7e12abf4ecc483f4e928c5cccc1b0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwmon/lm90.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.12",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (lm90) Prevent integer overflow/underflow in hysteresis calculations\n\nCommit b50aa49638c7 (\"hwmon: (lm90) Prevent integer underflows of\ntemperature calculations\") addressed a number of underflow situations\nwhen writing temperature limits. However, it missed one situation, seen\nwhen an attempt is made to set the hysteresis value to MAX_LONG and the\ncritical temperature limit is negative.\n\nUse clamp_val() when setting the hysteresis temperature to ensure that\nthe provided value can never overflow or underflow."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T13:48:00.367Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d105f30bea9104c590a9e5b495cb8a49bdfe405f"
        },
        {
          "url": "https://git.kernel.org/stable/c/55840b9eae5367b5d5b29619dc2fb7e4596dba46"
        }
      ],
      "title": "hwmon: (lm90) Prevent integer overflow/underflow in hysteresis calculations",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47098",
    "datePublished": "2024-03-04T18:10:50.282Z",
    "dateReserved": "2024-02-29T22:33:44.301Z",
    "dateUpdated": "2026-05-11T13:48:00.367Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47098",
      "date": "2026-05-20",
      "epss": "0.00015",
      "percentile": "0.03225"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nhwmon: (lm90) Prevent integer overflow/underflow in hysteresis calculations\\n\\nCommit b50aa49638c7 (\\\"hwmon: (lm90) Prevent integer underflows of\\ntemperature calculations\\\") addressed a number of underflow situations\\nwhen writing temperature limits. However, it missed one situation, seen\\nwhen an attempt is made to set the hysteresis value to MAX_LONG and the\\ncritical temperature limit is negative.\\n\\nUse clamp_val() when setting the hysteresis temperature to ensure that\\nthe provided value can never overflow or underflow.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: hwmon: (lm90) Previene el desbordamiento/desbordamiento insuficiente de enteros en los c\\u00e1lculos de hist\\u00e9resis del commit b50aa49638c7 (\\\"hwmon: (lm90) Evita el desbordamiento insuficiente de enteros en los c\\u00e1lculos de temperatura\\\") abord\\u00f3 una serie de situaciones de desbordamiento insuficiente al escribir. l\\u00edmites de temperatura. Sin embargo, omiti\\u00f3 una situaci\\u00f3n, vista cuando se intenta establecer el valor de hist\\u00e9resis en MAX_LONG y el l\\u00edmite de temperatura cr\\u00edtica es negativo. Utilice abrazadera_val() al configurar la temperatura de hist\\u00e9resis para garantizar que el valor proporcionado nunca pueda desbordarse o subestimarse.\"}]",
      "id": "CVE-2021-47098",
      "lastModified": "2024-11-21T06:35:23.650",
      "published": "2024-03-04T18:15:08.090",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/55840b9eae5367b5d5b29619dc2fb7e4596dba46\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/d105f30bea9104c590a9e5b495cb8a49bdfe405f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/55840b9eae5367b5d5b29619dc2fb7e4596dba46\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/d105f30bea9104c590a9e5b495cb8a49bdfe405f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47098\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-03-04T18:15:08.090\",\"lastModified\":\"2025-02-03T13:49:30.867\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nhwmon: (lm90) Prevent integer overflow/underflow in hysteresis calculations\\n\\nCommit b50aa49638c7 (\\\"hwmon: (lm90) Prevent integer underflows of\\ntemperature calculations\\\") addressed a number of underflow situations\\nwhen writing temperature limits. However, it missed one situation, seen\\nwhen an attempt is made to set the hysteresis value to MAX_LONG and the\\ncritical temperature limit is negative.\\n\\nUse clamp_val() when setting the hysteresis temperature to ensure that\\nthe provided value can never overflow or underflow.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: hwmon: (lm90) Previene el desbordamiento/desbordamiento insuficiente de enteros en los c\u00e1lculos de hist\u00e9resis del commit b50aa49638c7 (\\\"hwmon: (lm90) Evita el desbordamiento insuficiente de enteros en los c\u00e1lculos de temperatura\\\") abord\u00f3 una serie de situaciones de desbordamiento insuficiente al escribir. l\u00edmites de temperatura. Sin embargo, omiti\u00f3 una situaci\u00f3n, vista cuando se intenta establecer el valor de hist\u00e9resis en MAX_LONG y el l\u00edmite de temperatura cr\u00edtica es negativo. Utilice abrazadera_val() al configurar la temperatura de hist\u00e9resis para garantizar que el valor proporcionado nunca pueda desbordarse o subestimarse.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-190\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.14\",\"versionEndExcluding\":\"5.15.2\",\"matchCriteriaId\":\"83C305E4-14E2-4D1F-A9DF-39339AF95300\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"357AA433-37E8-4323-BFB2-3038D6E4B414\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"A73429BA-C2D9-4D0C-A75F-06A1CA8B3983\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F621B5E3-E99D-49E7-90B9-EC3B77C95383\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"F7BFDCAA-1650-49AA-8462-407DD593F94F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"6EC9882F-866D-4ACB-8FBC-213D8D8436C8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"8A0915FE-A4AA-4C94-B783-CF29D81E7E54\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/55840b9eae5367b5d5b29619dc2fb7e4596dba46\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d105f30bea9104c590a9e5b495cb8a49bdfe405f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/55840b9eae5367b5d5b29619dc2fb7e4596dba46\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d105f30bea9104c590a9e5b495cb8a49bdfe405f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d105f30bea9104c590a9e5b495cb8a49bdfe405f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/55840b9eae5367b5d5b29619dc2fb7e4596dba46\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:24:39.865Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47098\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:56:08.048392Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:17.305Z\"}}], \"cna\": {\"title\": \"hwmon: (lm90) Prevent integer overflow/underflow in hysteresis calculations\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"b50aa49638c7e12abf4ecc483f4e928c5cccc1b0\", \"lessThan\": \"d105f30bea9104c590a9e5b495cb8a49bdfe405f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b50aa49638c7e12abf4ecc483f4e928c5cccc1b0\", \"lessThan\": \"55840b9eae5367b5d5b29619dc2fb7e4596dba46\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/hwmon/lm90.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.14\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.14\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/hwmon/lm90.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d105f30bea9104c590a9e5b495cb8a49bdfe405f\"}, {\"url\": \"https://git.kernel.org/stable/c/55840b9eae5367b5d5b29619dc2fb7e4596dba46\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nhwmon: (lm90) Prevent integer overflow/underflow in hysteresis calculations\\n\\nCommit b50aa49638c7 (\\\"hwmon: (lm90) Prevent integer underflows of\\ntemperature calculations\\\") addressed a number of underflow situations\\nwhen writing temperature limits. However, it missed one situation, seen\\nwhen an attempt is made to set the hysteresis value to MAX_LONG and the\\ncritical temperature limit is negative.\\n\\nUse clamp_val() when setting the hysteresis temperature to ensure that\\nthe provided value can never overflow or underflow.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.12\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16\", \"versionStartIncluding\": \"5.14\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T07:04:07.860Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47098\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T07:04:07.860Z\", \"dateReserved\": \"2024-02-29T22:33:44.301Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-03-04T18:10:50.282Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.