CVE-2024-53682 regulator: axp20x: AXP717: set ramp_delay
Missing ramp delay configuration in the AXP717 regulator driver causes system crashes during CPU DVFS operations, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-53682?
CVE-2024-53682 is a medium-severity denial of service vulnerability in Linux kernel, published on 11 Jan 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
regulator: axp20x: AXP717: set ramp_delay
AXP717 datasheet says that regulator ramp delay is 15.625 us/step, which is 10mV in our case.
Add a AXP_DESC_RANGES_DELAY macro and update AXP_DESC_RANGES macro to expand to AXP_DESC_RANGES_DELAY with ramp_delay = 0
For DCDC4, steps is 100mv
Add a AXP_DESC_DELAY macro and update AXP_DESC macro to expand to AXP_DESC_DELAY with ramp_delay = 0
This patch fix crashes when using CPU DVFS.
Which versions are affected by CVE-2024-53682?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-53682?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-53682 being exploited?
There is no known exploitation of CVE-2024-53682 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-53682, DEBIAN-CVE-2024-53682, GHSA-77pj-c5wq-j7q7, UBUNTU-CVE-2024-53682.