Security readout for executives and security teams
Plain-English summary
A flaw in the Linux gpio-charger driver can access memory outside an allocated table when software requests a charging-current limit below a device’s nonzero minimum. Successful triggering could corrupt system behavior, expose limited data, or cause failure. Risk is concentrated in Linux systems that use this driver with the affected hardware configuration; it is not a general remote Linux vulnerability.
Executive priority
Prioritize remediation for devices confirmed to use the affected driver and hardware condition, especially shared or locally accessible systems. Treat broad server fleets without GPIO charger hardware as lower priority after verification. Because integrity and availability impacts are rated high, confirmed exposed devices should enter the next expedited maintenance cycle.
Technical view
The driver’s charge-current selection logic mishandles devices whose lowest supported current exceeds zero. A request below that minimum can leave the selected index equal to current_limit_map_size, producing an out-of-bounds memory access. CVSS 3.1 rates it 7.3: local, low complexity, low privileges, no user interaction, with potentially high integrity and availability impact.
Likely exposure
Likely exposure is limited to affected Linux kernels using the gpio-charger driver on devices configured with a nonzero lowest charge-current limit. The vulnerable path must receive a requested limit below that minimum. The bundle does not establish which distributions, products, or deployed hardware configurations expose this path by default.
Exploitation context
The supplied CVSS vector describes local exploitation requiring low privileges, not remote network access. CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a public exploit. Exact reachability and practical impact depend on driver availability, hardware configuration, and access controls around the charging-current interface.
Researcher notes
The decisive condition is an index reaching current_limit_map_size after a below-minimum request, followed by access beyond the allocated map. The bundle identifies multiple Linux stable commits but does not clearly map every affected and fixed release. Researchers should verify ancestry or vendor backports rather than relying only on displayed version strings.
Mitigation direction
- Apply the appropriate vendor or Linux stable update containing the cited gpio-charger correction.
- Prioritize embedded, mobile, or specialized Linux devices that use GPIO-controlled chargers.
- If immediate updating is unavailable, consult the device or distribution vendor for supported mitigations.
- Restrict untrusted local access to charge-current controls where operationally feasible.
Validation and detection
- Inventory kernel releases and compare their source or package changelogs with the cited stable fixes.
- Confirm whether the gpio-charger driver is built, loaded, or used on each device.
- Review hardware configuration for a charge-current map whose minimum value is greater than zero.
- Verify vendor updates in staging and monitor for charging, kernel, or stability regressions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-57792 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H1.85.5LinuxVulnerability scoring details
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/b29c7783ac1fe36d639c089cf471ac7a46df05f0CVE reference, Linux
- https://git.kernel.org/stable/c/c3703d9340ca2820e1ac63256f4b423ea8559831CVE reference, Linux
- https://git.kernel.org/stable/c/6abbbd8286b6f944eecf3c74444c138590135211CVE reference, Linux
- https://git.kernel.org/stable/c/13eb3cae1d8e23cce96c095abe34da8028c09ac5CVE reference, Linux
- https://git.kernel.org/stable/c/f6279a98db132da0cfff18712a1b06478c32007fCVE reference, Linux
- https://git.kernel.org/stable/c/afc6e39e824ad0e44b2af50a97885caec8d213d1CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.