fbdev: fb_pm2fb: Avoid potential divide by zero error
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: fbdev: fb_pm2fb: Avoid potential divide by zero error In `do_fb_ioctl()` of fbmem.c, if cmd is FBIOPUT_VSCREENINFO, var will be copied from user, then go through `fb_set_var()` and `info->fbops->fb_check_var()` which could may be `pm2fb_check_var()`. Along the path, `var->pixclock` won't be modified. This function checks whether reciprocal of `var->pixclock` is too high. If `var->pixclock` is zero, there will be a divide by zero error. So, it is necessary to check whether denominator is zero to avoid crash. As this bug is found by Syzkaller, logs are listed below. divide error in pm2fb_check_var Call Trace: <TASK> fb_set_var+0x367/0xeb0 drivers/video/fbdev/core/fbmem.c:1015 do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110 fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
Version range not reported
- Linux Linux
2.6.12
References 8
git.kernel.org
- stable/c/0f1174f4972ea9fad6becf8881d71adca8e9ca91
- stable/c/3ec326a6a0d4667585ca595f438c7293e5ced7c4
- stable/c/7f88cdfea8d7f4dbaf423d808241403b2bb945e4
- stable/c/7d9591b32a9092fc6391a316b56e8016c6181c3d
- stable/c/8fc778ee2fb2853f7a3531fa7273349640d8e4e9
- stable/c/34c3dea1189525cd533071ed5c176fc4ea8d982b
- stable/c/cb4bb011a683532841344ca7f281b5e04389b4f8
- stable/c/19f953e7435644b81332dd632ba1b2d80b1e37af