CVE-2023-52683

ACPI: LPIT: Avoid u32 multiplication overflow

MEDIUM

5.5

CVSS Score

Published: May 17, 2024 at 02:24 PM UTC

Updated: June 17, 2026 at 06:43 AM UTC

2 products affected across 2 vendorsLinux KernelDebian Linux

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: ACPI: LPIT: Avoid u32 multiplication overflow In lpit_update_residency() there is a possibility of overflow in multiplication, if tsc_khz is large enough (> UINT_MAX/1000). Change multiplication to mul_u32_u32(). Found by Linux Verification Center (linuxtesting.org) with SVACE.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Debian Linux · Debiandrupal

95%

10.0

Linux Kernel · Linux

95%

4.15 ≤ v < 4.19.3064.15 ≤ v < 5.10.2094.15 ≤ v < 5.15.1484.15 ≤ v < 5.4.2684.15 ≤ v < 6.1.754.15 ≤ v < 6.6.144.15 ≤ v < 6.7.24.15 ≤ v < 6.84.20 ≤ v < 5.4.2685.11 ≤ v < 5.15.1485.16 ≤ v < 6.1.755.5 ≤ v < 5.10.2096.2 ≤ v < 6.6.146.7 ≤ v < 6.7.24.15eeb2d80d502af28e5660ff4bbe00f90ceb82c2db

Vendor states this is fixed in 56d2eeda87995245300836ee4dbd13b002311782 (fixed)

Vendor states this is fixed in 647d1d50c31e60ef9ccb9756a8fdf863329f7aee (fixed)

Vendor states this is fixed in 6c38e791bde07d6ca2a0a619ff9b6837e0d5f9ad (fixed)

Vendor states this is fixed in 72222dfd76a79d9666ab3117fcdd44ca8cd0c4de (fixed)

Vendor states this is fixed in b7aab9d906e2e252a7783f872406033ec49b6dae (fixed)

Vendor states this is fixed in c1814a4ffd016ce5392c6767d22ef3aa2f0d4bd1 (fixed)

Vendor states this is fixed in d1ac288b2742aa4af746c5613bac71760fadd1c4 (fixed)

Vendor states this is fixed in f39c3d578c7d09a18ceaf56750fc7f20b02ada63 (fixed)

Vendor states this is fixed in 4.15 (unaffected)

Vendor states this is fixed in 4.19.306 (unaffected)

Vendor states this is fixed in 5.10.209 (unaffected)

Vendor states this is fixed in 5.15.148 (unaffected)