CVE-2024-39475

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-39475
In the Linux kernel, the following vulnerability has been resolved: fbdev: savage: Handle err return when savagefb_check_var failed The commit 04e5eac8f3ab("fbdev: savage: Error out if pixclock equals zero") checks the value of pixclock to avoid divide-by-zero error. However the function savagefb_probe doesn't handle the error return of savagefb_check_var. When pixclock is 0, it will cause divide-by-zero error.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/32f92b0078ebf79dbe4827288e0acb50d89d3d5b Mailing List Patch
https://git.kernel.org/stable/c/4b2c67e30b4e1d2ae19dba8b8e8f3b5fd3cf8089 Mailing List Patch
https://git.kernel.org/stable/c/5f446859bfa46df0ffb34149499f48a2c2d8cd95 Mailing List Patch
https://git.kernel.org/stable/c/6ad959b6703e2c4c5d7af03b4cfd5ff608036339 Mailing List Patch
https://git.kernel.org/stable/c/86435f39c18967cdd937d7a49ba539cdea7fb547 Mailing List Patch
https://git.kernel.org/stable/c/b8385ff814ca4cb7e63789841e6ec2a14c73e1e8 Mailing List Patch
https://git.kernel.org/stable/c/be754cbd77eaf2932408a4e18532e4945274a5c7 Mailing List Patch
https://git.kernel.org/stable/c/edaa57480b876e8203b51df7c3d14a51ea6b09e3 Mailing List Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

08 Jul 2024, 17:11

Type Values Removed Values Added
CWE CWE-369
First Time Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/32f92b0078ebf79dbe4827288e0acb50d89d3d5b - () https://git.kernel.org/stable/c/32f92b0078ebf79dbe4827288e0acb50d89d3d5b - Mailing List, Patch
References () https://git.kernel.org/stable/c/4b2c67e30b4e1d2ae19dba8b8e8f3b5fd3cf8089 - () https://git.kernel.org/stable/c/4b2c67e30b4e1d2ae19dba8b8e8f3b5fd3cf8089 - Mailing List, Patch
References () https://git.kernel.org/stable/c/5f446859bfa46df0ffb34149499f48a2c2d8cd95 - () https://git.kernel.org/stable/c/5f446859bfa46df0ffb34149499f48a2c2d8cd95 - Mailing List, Patch
References () https://git.kernel.org/stable/c/6ad959b6703e2c4c5d7af03b4cfd5ff608036339 - () https://git.kernel.org/stable/c/6ad959b6703e2c4c5d7af03b4cfd5ff608036339 - Mailing List, Patch
References () https://git.kernel.org/stable/c/86435f39c18967cdd937d7a49ba539cdea7fb547 - () https://git.kernel.org/stable/c/86435f39c18967cdd937d7a49ba539cdea7fb547 - Mailing List, Patch
References () https://git.kernel.org/stable/c/b8385ff814ca4cb7e63789841e6ec2a14c73e1e8 - () https://git.kernel.org/stable/c/b8385ff814ca4cb7e63789841e6ec2a14c73e1e8 - Mailing List, Patch
References () https://git.kernel.org/stable/c/be754cbd77eaf2932408a4e18532e4945274a5c7 - () https://git.kernel.org/stable/c/be754cbd77eaf2932408a4e18532e4945274a5c7 - Mailing List, Patch
References () https://git.kernel.org/stable/c/edaa57480b876e8203b51df7c3d14a51ea6b09e3 - () https://git.kernel.org/stable/c/edaa57480b876e8203b51df7c3d14a51ea6b09e3 - Mailing List, Patch

05 Jul 2024, 12:55

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: fbdev: savage: Maneja el retorno de error cuando falla savagefb_check_var. El commit 04e5eac8f3ab("fbdev: savage: Error out if pixclock es igual a cero") verifica el valor de pixclock para evitar división por error cero. Sin embargo, la función savagefb_probe no maneja la devolución de error de savagefb_check_var. Cuando pixclock es 0, provocará un error de división por cero.

05 Jul 2024, 07:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-05 07:15

Updated : 2024-07-08 17:11

NVD link : CVE-2024-39475

Mitre link : CVE-2024-39475

CVE.ORG link : CVE-2024-39475

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-369

Divide By Zero