github - ghsa-h3gf-rw88-73j5

ghsa-h3gf-rw88-73j5

Vulnerability from github

Published

2024-07-29 18:30

Modified

2024-07-29 18:30

Details

In the Linux kernel, the following vulnerability has been resolved:

iio: chemical: bme680: Fix overflows in compensate() functions

There are cases in the compensate functions of the driver that there could be overflows of variables due to bit shifting ops. These implications were initially discussed here 1 and they were mentioned in log message of Commit 1b3bd8592780 ("iio: chemical: Add support for Bosch BME680 sensor").

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-42086"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-29T17:15:11Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: chemical: bme680: Fix overflows in compensate() functions\n\nThere are cases in the compensate functions of the driver that\nthere could be overflows of variables due to bit shifting ops.\nThese implications were initially discussed here [1] and they\nwere mentioned in log message of Commit 1b3bd8592780 (\"iio:\nchemical: Add support for Bosch BME680 sensor\").\n\n[1]: https://lore.kernel.org/linux-iio/20180728114028.3c1bbe81@archlinux/",
  "id": "GHSA-h3gf-rw88-73j5",
  "modified": "2024-07-29T18:30:41Z",
  "published": "2024-07-29T18:30:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42086"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3add41bbda92938e9a528d74659dfc552796be4e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6fa31bbe2ea8665ee970258eb8320cbf231dbe9e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7a13d1357658d3a3c1cd7b3b9543c805a6e5e6e9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b0af334616ed425024bf220adda0f004806b5feb"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b5967393d50e3c6e632efda3ea3fdde14c1bfd0e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ba1bb3e2a38a7fef1c1818dd4f2d9abbfdde553a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c326551e99f5416986074ce78bef94f6a404b517"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fdd478c3ae98c3f13628e110dce9b6cfb0d9b3c8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

cve-2024-42086

Vulnerability from cvelistv5

Published

2024-07-29 16:26

Modified

2024-11-05 09:37

Severity ?

Summary

iio: chemical: bme680: Fix overflows in compensate() functions

References

▼	URL	Tags
	https://git.kernel.org/stable/c/6fa31bbe2ea8665ee970258eb8320cbf231dbe9e
	https://git.kernel.org/stable/c/b0af334616ed425024bf220adda0f004806b5feb
	https://git.kernel.org/stable/c/c326551e99f5416986074ce78bef94f6a404b517
	https://git.kernel.org/stable/c/7a13d1357658d3a3c1cd7b3b9543c805a6e5e6e9
	https://git.kernel.org/stable/c/ba1bb3e2a38a7fef1c1818dd4f2d9abbfdde553a
	https://git.kernel.org/stable/c/b5967393d50e3c6e632efda3ea3fdde14c1bfd0e
	https://git.kernel.org/stable/c/3add41bbda92938e9a528d74659dfc552796be4e
	https://git.kernel.org/stable/c/fdd478c3ae98c3f13628e110dce9b6cfb0d9b3c8

Impacted products

Vendor

Product

Version

▼

Linux

Version: 1b3bd8592780
Version: 1b3bd8592780
Version: 1b3bd8592780
Version: 1b3bd8592780
Version: 1b3bd8592780
Version: 1b3bd8592780
Version: 1b3bd8592780
Version: 1b3bd8592780

Linux

Version: 4.19

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:54:31.959Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6fa31bbe2ea8665ee970258eb8320cbf231dbe9e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b0af334616ed425024bf220adda0f004806b5feb"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c326551e99f5416986074ce78bef94f6a404b517"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7a13d1357658d3a3c1cd7b3b9543c805a6e5e6e9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ba1bb3e2a38a7fef1c1818dd4f2d9abbfdde553a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b5967393d50e3c6e632efda3ea3fdde14c1bfd0e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3add41bbda92938e9a528d74659dfc552796be4e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fdd478c3ae98c3f13628e110dce9b6cfb0d9b3c8"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42086",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:18:54.149750Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:56.982Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/chemical/bme680_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6fa31bbe2ea8",
              "status": "affected",
              "version": "1b3bd8592780",
              "versionType": "git"
            },
            {
              "lessThan": "b0af334616ed",
              "status": "affected",
              "version": "1b3bd8592780",
              "versionType": "git"
            },
            {
              "lessThan": "c326551e99f5",
              "status": "affected",
              "version": "1b3bd8592780",
              "versionType": "git"
            },
            {
              "lessThan": "7a13d1357658",
              "status": "affected",
              "version": "1b3bd8592780",
              "versionType": "git"
            },
            {
              "lessThan": "ba1bb3e2a38a",
              "status": "affected",
              "version": "1b3bd8592780",
              "versionType": "git"
            },
            {
              "lessThan": "b5967393d50e",
              "status": "affected",
              "version": "1b3bd8592780",
              "versionType": "git"
            },
            {
              "lessThan": "3add41bbda92",
              "status": "affected",
              "version": "1b3bd8592780",
              "versionType": "git"
            },
            {
              "lessThan": "fdd478c3ae98",
              "status": "affected",
              "version": "1b3bd8592780",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/chemical/bme680_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.317",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.279",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: chemical: bme680: Fix overflows in compensate() functions\n\nThere are cases in the compensate functions of the driver that\nthere could be overflows of variables due to bit shifting ops.\nThese implications were initially discussed here [1] and they\nwere mentioned in log message of Commit 1b3bd8592780 (\"iio:\nchemical: Add support for Bosch BME680 sensor\").\n\n[1]: https://lore.kernel.org/linux-iio/20180728114028.3c1bbe81@archlinux/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-05T09:37:07.958Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6fa31bbe2ea8665ee970258eb8320cbf231dbe9e"
        },
        {
          "url": "https://git.kernel.org/stable/c/b0af334616ed425024bf220adda0f004806b5feb"
        },
        {
          "url": "https://git.kernel.org/stable/c/c326551e99f5416986074ce78bef94f6a404b517"
        },
        {
          "url": "https://git.kernel.org/stable/c/7a13d1357658d3a3c1cd7b3b9543c805a6e5e6e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba1bb3e2a38a7fef1c1818dd4f2d9abbfdde553a"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5967393d50e3c6e632efda3ea3fdde14c1bfd0e"
        },
        {
          "url": "https://git.kernel.org/stable/c/3add41bbda92938e9a528d74659dfc552796be4e"
        },
        {
          "url": "https://git.kernel.org/stable/c/fdd478c3ae98c3f13628e110dce9b6cfb0d9b3c8"
        }
      ],
      "title": "iio: chemical: bme680: Fix overflows in compensate() functions",
      "x_generator": {
        "engine": "bippy-9e1c9544281a"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42086",
    "datePublished": "2024-07-29T16:26:27.075Z",
    "dateReserved": "2024-07-29T15:50:41.170Z",
    "dateUpdated": "2024-11-05T09:37:07.958Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted