CVE-2024-57792 (GCVE-0-2024-57792)
Vulnerability from cvelistv5
Published
2025-01-11 12:39
Modified
2026-08-05 11:46
Severity ?
7.3 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: power: supply: gpio-charger: Fix set charge current limits Fix set charge current limits for devices which allow to set the lowest charge current limit to be greater zero. If requested charge current limit is below lowest limit, the index equals current_limit_map_size which leads to accessing memory beyond allocated memory.
References
Impacted products
Vendor Product Version
Linux Linux Version: be2919d8355e4651386ad2fb61ddb6efe4533b1b
Version: be2919d8355e4651386ad2fb61ddb6efe4533b1b
Version: be2919d8355e4651386ad2fb61ddb6efe4533b1b
Version: be2919d8355e4651386ad2fb61ddb6efe4533b1b
Version: be2919d8355e4651386ad2fb61ddb6efe4533b1b
Version: be2919d8355e4651386ad2fb61ddb6efe4533b1b
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:54:31.384Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/power/supply/gpio-charger.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b29c7783ac1fe36d639c089cf471ac7a46df05f0",
              "status": "affected",
              "version": "be2919d8355e4651386ad2fb61ddb6efe4533b1b",
              "versionType": "git"
            },
            {
              "lessThan": "c3703d9340ca2820e1ac63256f4b423ea8559831",
              "status": "affected",
              "version": "be2919d8355e4651386ad2fb61ddb6efe4533b1b",
              "versionType": "git"
            },
            {
              "lessThan": "6abbbd8286b6f944eecf3c74444c138590135211",
              "status": "affected",
              "version": "be2919d8355e4651386ad2fb61ddb6efe4533b1b",
              "versionType": "git"
            },
            {
              "lessThan": "13eb3cae1d8e23cce96c095abe34da8028c09ac5",
              "status": "affected",
              "version": "be2919d8355e4651386ad2fb61ddb6efe4533b1b",
              "versionType": "git"
            },
            {
              "lessThan": "f6279a98db132da0cfff18712a1b06478c32007f",
              "status": "affected",
              "version": "be2919d8355e4651386ad2fb61ddb6efe4533b1b",
              "versionType": "git"
            },
            {
              "lessThan": "afc6e39e824ad0e44b2af50a97885caec8d213d1",
              "status": "affected",
              "version": "be2919d8355e4651386ad2fb61ddb6efe4533b1b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/power/supply/gpio-charger.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.233",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.123",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.69",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.233",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.176",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.123",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.69",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.8",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: gpio-charger: Fix set charge current limits\n\nFix set charge current limits for devices which allow to set the lowest\ncharge current limit to be greater zero. If requested charge current limit\nis below lowest limit, the index equals current_limit_map_size which leads\nto accessing memory beyond allocated memory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The only path to `set_charge_current_limit()` is a write to the sysfs attribute `/sys/class/power_supply/\u003cname\u003e/constant_charge_current_max`, handled by `power_supply_store_property()`; there is no network, adjacent-network, or bus-remote route into this platform driver.\nAC:L - On an affected board (lowest mapped `limit_ua \u003e 0`) a single `echo 0 \u003e constant_charge_current_max` deterministically drives the index to `current_limit_map_size` and performs the out-of-bounds read, with no race, timing window, or memory-layout precondition to win; the attacker can repeat it arbitrarily to re-sample heap contents.\nPR:L - The kernel path performs no `capable()`/capability check whatsoever \u2014 the sole gate is filesystem DAC on the sysfs node, and on the embedded, industrial and Android systems where gpio-charger current-limit mapping is actually deployed, that node is routinely chowned/chgrped by ueventd or udev rules to a non-root service account or power group so the charging daemon can throttle current; reading back the leaked value needs no privilege at all since the attribute is 0444.\nUI:N - The attacker performs the write and the subsequent read entirely on their own; no victim action, no device hotplug, and no administrator operation is needed.\nS:U - The disclosed memory, the corrupted driver state, and the mis-driven GPIO lines are all managed by the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:L - Eight bytes of stale kernel heap at a fixed offset one element past the `devm_kmalloc_array()` map are read, and the `limit_ua` half is stored into `charge_current_limit` and handed to userspace through the world-readable `constant_charge_current_max` attribute \u2014 a repeatable heap oracle usable to leak a kernel pointer, but strictly bounded to a few bytes rather than arbitrary memory.\nI:H - The out-of-bounds `gpiodata` is shifted onto up to 32 charge-current-limit GPIO lines, and an attacker who grooms the adjacent slab slot controls that bit pattern, letting them force the charger IC to a current limit outside every legitimate mapping entry \u2014 precisely the condition the fix guards against \"for safety reasons\" \u2014 while the reported limit is falsified so monitoring cannot detect the mismatch; malicious modification of this single setting presents a direct, serious consequence (battery overcurrent, thermal damage) to the impacted component.\nA:H - The garbage bit pattern can select a charger state unreachable through the sanctioned mapping, including one that disables charging on a board whose lowest legitimate limit is nonzero, so a battery-powered industrial, medical, or embedded device drains and powers off entirely; the misconfiguration persists until re-set and can be reapplied at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:46:32.595Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b29c7783ac1fe36d639c089cf471ac7a46df05f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3703d9340ca2820e1ac63256f4b423ea8559831"
        },
        {
          "url": "https://git.kernel.org/stable/c/6abbbd8286b6f944eecf3c74444c138590135211"
        },
        {
          "url": "https://git.kernel.org/stable/c/13eb3cae1d8e23cce96c095abe34da8028c09ac5"
        },
        {
          "url": "https://git.kernel.org/stable/c/f6279a98db132da0cfff18712a1b06478c32007f"
        },
        {
          "url": "https://git.kernel.org/stable/c/afc6e39e824ad0e44b2af50a97885caec8d213d1"
        }
      ],
      "title": "power: supply: gpio-charger: Fix set charge current limits",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-57792",
    "datePublished": "2025-01-11T12:39:46.397Z",
    "dateReserved": "2025-01-11T12:33:33.683Z",
    "dateUpdated": "2026-08-05T11:46:32.595Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.