CVE-2021-47098·Kernel vulnerability
In the Linux kernel, the following vulnerability has been resolved: hwmon: (lm90) Prevent integer overflow/underflow in hysteresis calculations Commit b50aa49638c7 ("hwmon: (lm90) Prevent integer underflows of temperature calculations") addressed a number of underflow situations when writing temperature limits. However, it missed one situation, seen when an attempt is made to set the hysteresis value to MAX_LONG and the critical temperature limit is negative. Use clamp_val() when setting the hysteresis temperature to ensure that the provided value can never overflow or underflow.
- Severity
- high
- Software
- Kernel
- Fixed in
- 5.15.2
- Published
- 2024-03-04
Affected versions
From: 5.14
Until: 5.15.2
Fixed in: 5.15.2
How to fix this CVE
Update your Linux kernel to version 5.15.2 or later to resolve an integer overflow/underflow vulnerability in the lm90 hardware monitoring driver's hysteresis calculation logic. This vulnerability could allow local users with sufficient privileges to trigger memory corruption or denial of service through specially crafted temperature limit values. Apply the latest kernel security updates available for your distribution to ensure complete protection.
sudo dnf update kernel kernel-develDefensia detects this vulnerability
How to check if you are affected
- Check installed kernel version: uname -r — ensure version is 5.15.2 or later
- Verify lm90 driver is loaded: lsmod | grep lm90 — if present, the vulnerable component is active
- Search system logs for hwmon-related errors: sudo grep -i 'lm90\|hwmon' /var/log/kern.log /var/log/syslog — look for temperature calculation warnings or overflow messages
- Confirm patch applied: sudo strings /boot/vmlinuz-$(uname -r) | grep -i 'clamp_val' or verify kernel compilation date post-fix release
FAQ
What is CVE-2021-47098?
This vulnerability exists in the lm90 hardware monitoring driver where integer arithmetic operations on temperature hysteresis values could overflow or underflow when combining extreme values (such as MAX_LONG hysteresis with negative critical temperature limits), potentially leading to kernel memory corruption.
Is CVE-2021-47098 being actively exploited?
No, this CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog, and no public exploits are documented. However, the vulnerability remains serious due to its potential for privilege escalation by local attackers.
What versions of Kernel are affected by CVE-2021-47098?
Linux kernel versions 5.14 through 5.15.1 are vulnerable. Version 5.15.2 and later include the remediation using clamp_val() to prevent arithmetic overflow/underflow conditions.
How do I check if my server is vulnerable to CVE-2021-47098?
Run 'uname -r' to check your kernel version. If the output shows version 5.14.x or 5.15.0-5.15.1, your system is vulnerable. Additionally, confirm lm90 driver presence with 'lsmod | grep lm90'.
Does Defensia detect CVE-2021-47098?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Linux kernel is installed on a monitored server, CVE-2021-47098 will appear in your dashboard with remediation steps.
Related Kernel CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2021-47098. Free for 1 server.
Get started free