fbdev: savage: Handle err return when savagefb_check_var failed (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.23 % · percentile 14 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: fbdev: savage: Handle err return when savagefb_check_var failed The commit 04e5eac8f3ab("fbdev: savage: Error out if pixclock equals zero") checks the value of pixclock to avoid divide-by-zero error. However the function savagefb_probe doesn't handle the error return of savagefb_check_var. When pixclock is 0, it will cause divide-by-zero error.
Weaknesses (CWE)
- CWE-369 — Divide By Zero
References
- https://git.kernel.org/stable/c/be754cbd77eaf2932408a4e18532e4945274a5c7
- https://git.kernel.org/stable/c/86435f39c18967cdd937d7a49ba539cdea7fb547
- https://git.kernel.org/stable/c/32f92b0078ebf79dbe4827288e0acb50d89d3d5b
- https://git.kernel.org/stable/c/4b2c67e30b4e1d2ae19dba8b8e8f3b5fd3cf8089
- https://git.kernel.org/stable/c/edaa57480b876e8203b51df7c3d14a51ea6b09e3
- https://git.kernel.org/stable/c/b8385ff814ca4cb7e63789841e6ec2a14c73e1e8
- https://git.kernel.org/stable/c/5f446859bfa46df0ffb34149499f48a2c2d8cd95
- https://git.kernel.org/stable/c/6ad959b6703e2c4c5d7af03b4cfd5ff608036339
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2024-38000
- GCVE · GCVE-0-2024-39475
CERT-FR advisories
- CERTFR-2024-AVI-0823 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0799 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0778 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0717 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0716 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0694 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0693 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0669 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0667 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0613 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0610 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.19 < 4.19.316cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.4 < 5.4.278cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.10 < 5.10.219cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.15 < 5.15.161cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.1 < 6.1.94cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.6 < 6.6.34cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.9 < 6.9.5
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 224453de8505aede1890f007be973925a3edf6a1 < be754cbd77eaf2932408a4e18532e4945274a5c7 ; affected 84dce0f6a4cc5b7bfd7242ef9290db8ac1dd77ff < 86435f39c18967cdd937d7a49ba539cdea7fb547 ; affected 512ee6d6041e007ef5bf200c6e388e172a2c5b24 < 32f92b0078ebf79dbe4827288e0acb50d89d3d5b ; affected 8c54acf33e5adaad6374bf3ec1e3aff0591cc8e1 < 4b2c67e30b4e1d2ae19dba8b8e8f3b5fd3cf8089 ; affected 070398d32c5f3ab0e890374904ad94551c76aec4 < edaa57480b876e8203b51df7c3d14a51ea6b09e3 ; affected bc3c2e58d73b28b9a8789fca84778ee165a72d13 < b8385ff814ca4cb7e63789841e6ec2a14c73e1e8 |
| Linux · Linux | affected 6.8 ; unaffected 0 < 6.8 ; unaffected 4.19.316 ≤ 4.19.* ; unaffected 5.4.278 ≤ 5.4.* ; unaffected 5.10.219 ≤ 5.10.* ; unaffected 5.15.161 ≤ 5.15.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |