In the Linux kernel, the following vulnerability has been resolved:
video: fbdev: arkfb: Fix a divide-by-zero bug in arksetpixclock()
Since the user can control the arguments of the ioctl() from the user space, under special arguments that may result in a divide-by-zero bug in: drivers/video/fbdev/arkfb.c:784: arksetpixclock(info, (hdiv * info->var.pixclock) / hmul); with hdiv=1, pixclock=1 and hmul=2 you end up with (1*1)/2 = (int) 0. and then in: drivers/video/fbdev/arkfb.c:504: rv = dacsetfreq(par->dac, 0, 1000000000 / pixclock); we'll get a division-by-zero.
The following log can reveal it:
divide error: 0000 [#1] PREEMPT SMP KASAN PTI RIP: 0010:arksetpixclock drivers/video/fbdev/arkfb.c:504 [inline] RIP: 0010:arkfbsetpar+0x10fc/0x24c0 drivers/video/fbdev/arkfb.c:784 Call Trace: fbsetvar+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1034 dofbioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110 fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189
Fix this by checking the argument of arksetpixclock() first.
{ "vanir_signatures": [ { "signature_type": "Function", "target": { "file": "drivers/video/fbdev/arkfb.c", "function": "arkfb_set_par" }, "id": "CVE-2022-50102-03ef83ec", "digest": { "length": 5565.0, "function_hash": "183458374034950281351500598134114768851" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f1c4523f7a3aaabe7e53d3ebd378292947e95c8", "signature_version": "v1" }, { "signature_type": "Line", "target": { "file": "drivers/video/fbdev/arkfb.c" }, "id": "CVE-2022-50102-1337f8c3", "digest": { "threshold": 0.9, "line_hashes": [ "326247945489904758249592511576540338516", "195729720152665682112948665682032818246", "339798924723138632712964566095657709324", "6110919237818400865329559070129906460" ] }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15661642511b2b192077684a89f42a8d95d54286", "signature_version": "v1" }, { "signature_type": "Line", "target": { "file": "drivers/video/fbdev/arkfb.c" }, "id": "CVE-2022-50102-25be37c7", "digest": { "threshold": 0.9, "line_hashes": [ "326247945489904758249592511576540338516", "195729720152665682112948665682032818246", "339798924723138632712964566095657709324", "6110919237818400865329559070129906460" ] }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@236c1502520b7b08955467ec2e50b3232e34f1f9", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "drivers/video/fbdev/arkfb.c", "function": "arkfb_set_par" }, "id": "CVE-2022-50102-29016d5c", "digest": { "length": 5565.0, "function_hash": "183458374034950281351500598134114768851" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9ebc5031958c1f3a2795e4533b4091d77c738d14", "signature_version": "v1" }, { "signature_type": "Line", "target": { "file": "drivers/video/fbdev/arkfb.c" }, "id": "CVE-2022-50102-34da405d", "digest": { "threshold": 0.9, "line_hashes": [ "326247945489904758249592511576540338516", "195729720152665682112948665682032818246", "339798924723138632712964566095657709324", "6110919237818400865329559070129906460" ] }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f1c4523f7a3aaabe7e53d3ebd378292947e95c8", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "drivers/video/fbdev/arkfb.c", "function": "arkfb_set_par" }, "id": "CVE-2022-50102-3c0569b4", "digest": { "length": 5565.0, "function_hash": "183458374034950281351500598134114768851" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b9a66f23612b84617e04412169e155a4b92f632d", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "drivers/video/fbdev/arkfb.c", "function": "arkfb_set_par" }, "id": "CVE-2022-50102-48418425", "digest": { "length": 5565.0, "function_hash": "183458374034950281351500598134114768851" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15661642511b2b192077684a89f42a8d95d54286", "signature_version": "v1" }, { "signature_type": "Line", "target": { "file": "drivers/video/fbdev/arkfb.c" }, "id": "CVE-2022-50102-48ffbb7c", "digest": { "threshold": 0.9, "line_hashes": [ "326247945489904758249592511576540338516", "195729720152665682112948665682032818246", "339798924723138632712964566095657709324", "6110919237818400865329559070129906460" ] }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a249e1b89ca25e1c34bdf96154e3f6224a91a9af", "signature_version": "v1" }, { "signature_type": "Line", "target": { "file": "drivers/video/fbdev/arkfb.c" }, "id": "CVE-2022-50102-7ffa3391", "digest": { "threshold": 0.9, "line_hashes": [ "326247945489904758249592511576540338516", "195729720152665682112948665682032818246", "339798924723138632712964566095657709324", "6110919237818400865329559070129906460" ] }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9ebc5031958c1f3a2795e4533b4091d77c738d14", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "drivers/video/fbdev/arkfb.c", "function": "arkfb_set_par" }, "id": "CVE-2022-50102-98434a2f", "digest": { "length": 5565.0, "function_hash": "183458374034950281351500598134114768851" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@236c1502520b7b08955467ec2e50b3232e34f1f9", "signature_version": "v1" }, { "signature_type": "Line", "target": { "file": "drivers/video/fbdev/arkfb.c" }, "id": "CVE-2022-50102-992e9185", "digest": { "threshold": 0.9, "line_hashes": [ "326247945489904758249592511576540338516", "195729720152665682112948665682032818246", "339798924723138632712964566095657709324", "6110919237818400865329559070129906460" ] }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0288fa799e273b08839037499d704dc7bdc13e9a", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "drivers/video/fbdev/arkfb.c", "function": "arkfb_set_par" }, "id": "CVE-2022-50102-cc1239af", "digest": { "length": 5565.0, "function_hash": "183458374034950281351500598134114768851" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a249e1b89ca25e1c34bdf96154e3f6224a91a9af", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "drivers/video/fbdev/arkfb.c", "function": "arkfb_set_par" }, "id": "CVE-2022-50102-ce7ed3c7", "digest": { "length": 5565.0, "function_hash": "183458374034950281351500598134114768851" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0288fa799e273b08839037499d704dc7bdc13e9a", "signature_version": "v1" }, { "signature_type": "Line", "target": { "file": "drivers/video/fbdev/arkfb.c" }, "id": "CVE-2022-50102-d011be53", "digest": { "threshold": 0.9, "line_hashes": [ "326247945489904758249592511576540338516", "195729720152665682112948665682032818246", "339798924723138632712964566095657709324", "6110919237818400865329559070129906460" ] }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76b3f0a0b56e53a960a14624a0f48b3d94b5e7e7", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "drivers/video/fbdev/arkfb.c", "function": "arkfb_set_par" }, "id": "CVE-2022-50102-d64f0447", "digest": { "length": 5565.0, "function_hash": "183458374034950281351500598134114768851" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76b3f0a0b56e53a960a14624a0f48b3d94b5e7e7", "signature_version": "v1" }, { "signature_type": "Line", "target": { "file": "drivers/video/fbdev/arkfb.c" }, "id": "CVE-2022-50102-eb6a0fbf", "digest": { "threshold": 0.9, "line_hashes": [ "326247945489904758249592511576540338516", "195729720152665682112948665682032818246", "339798924723138632712964566095657709324", "6110919237818400865329559070129906460" ] }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b9a66f23612b84617e04412169e155a4b92f632d", "signature_version": "v1" } ] }