CVE-2022-50102

Source
https://nvd.nist.gov/vuln/detail/CVE-2022-50102
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50102.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-50102
Downstream
Related
Published
2025-06-18T11:15:39Z
Modified
2025-08-09T19:01:26Z
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

video: fbdev: arkfb: Fix a divide-by-zero bug in arksetpixclock()

Since the user can control the arguments of the ioctl() from the user space, under special arguments that may result in a divide-by-zero bug in: drivers/video/fbdev/arkfb.c:784: arksetpixclock(info, (hdiv * info->var.pixclock) / hmul); with hdiv=1, pixclock=1 and hmul=2 you end up with (1*1)/2 = (int) 0. and then in: drivers/video/fbdev/arkfb.c:504: rv = dacsetfreq(par->dac, 0, 1000000000 / pixclock); we'll get a division-by-zero.

The following log can reveal it:

divide error: 0000 [#1] PREEMPT SMP KASAN PTI RIP: 0010:arksetpixclock drivers/video/fbdev/arkfb.c:504 [inline] RIP: 0010:arkfbsetpar+0x10fc/0x24c0 drivers/video/fbdev/arkfb.c:784 Call Trace: fbsetvar+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1034 dofbioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110 fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189

Fix this by checking the argument of arksetpixclock() first.

References

Affected packages