In the Linux kernel, the following vulnerability has been resolved:
fbdev: savage: Error out if pixclock equals zero
The userspace program could pass any values to the driver through ioctl() interface. If the driver doesn't check the value of pixclock, it may cause divide-by-zero error.
Although pixclock is checked in savagefbdecodevar(), but it is not checked properly in savagefbprobe(). Fix this by checking whether pixclock is zero in the function savagefbcheck_var() before info->var.pixclock is used as the divisor.
This is similar to CVE-2022-3061 in i740fb which was fixed by commit 15cf0b8.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9ca4e80d23474f90841251f4ac0d941fa337a01",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "savagefb_check_var",
"file": "drivers/video/fbdev/savage/savagefb_driver.c"
},
"id": "CVE-2024-26778-01ad3b3d",
"signature_type": "Function",
"digest": {
"length": 2597.0,
"function_hash": "20462788293594373736141515580883780979"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bc3c2e58d73b28b9a8789fca84778ee165a72d13",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "savagefb_check_var",
"file": "drivers/video/fbdev/savage/savagefb_driver.c"
},
"id": "CVE-2024-26778-0da854c7",
"signature_type": "Function",
"digest": {
"length": 2597.0,
"function_hash": "20462788293594373736141515580883780979"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@224453de8505aede1890f007be973925a3edf6a1",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/savage/savagefb_driver.c"
},
"id": "CVE-2024-26778-42c1e7af",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"57616490291304127224159957492176507860",
"321449740823879040518581021431963005359",
"206085287443723135579604465457228019743"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@512ee6d6041e007ef5bf200c6e388e172a2c5b24",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "savagefb_check_var",
"file": "drivers/video/fbdev/savage/savagefb_driver.c"
},
"id": "CVE-2024-26778-50d293d2",
"signature_type": "Function",
"digest": {
"length": 2597.0,
"function_hash": "20462788293594373736141515580883780979"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@84dce0f6a4cc5b7bfd7242ef9290db8ac1dd77ff",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "savagefb_check_var",
"file": "drivers/video/fbdev/savage/savagefb_driver.c"
},
"id": "CVE-2024-26778-6c3139a3",
"signature_type": "Function",
"digest": {
"length": 2597.0,
"function_hash": "20462788293594373736141515580883780979"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@04e5eac8f3ab2ff52fa191c187a46d4fdbc1e288",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "savagefb_check_var",
"file": "drivers/video/fbdev/savage/savagefb_driver.c"
},
"id": "CVE-2024-26778-6e477bb3",
"signature_type": "Function",
"digest": {
"length": 2597.0,
"function_hash": "20462788293594373736141515580883780979"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@04e5eac8f3ab2ff52fa191c187a46d4fdbc1e288",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/savage/savagefb_driver.c"
},
"id": "CVE-2024-26778-791dab53",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"57616490291304127224159957492176507860",
"321449740823879040518581021431963005359",
"206085287443723135579604465457228019743"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@224453de8505aede1890f007be973925a3edf6a1",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "savagefb_check_var",
"file": "drivers/video/fbdev/savage/savagefb_driver.c"
},
"id": "CVE-2024-26778-80592994",
"signature_type": "Function",
"digest": {
"length": 2597.0,
"function_hash": "20462788293594373736141515580883780979"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9ca4e80d23474f90841251f4ac0d941fa337a01",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/savage/savagefb_driver.c"
},
"id": "CVE-2024-26778-a0ae403b",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"57616490291304127224159957492176507860",
"321449740823879040518581021431963005359",
"206085287443723135579604465457228019743"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@512ee6d6041e007ef5bf200c6e388e172a2c5b24",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/savage/savagefb_driver.c"
},
"id": "CVE-2024-26778-a426a699",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"57616490291304127224159957492176507860",
"321449740823879040518581021431963005359",
"206085287443723135579604465457228019743"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@070398d32c5f3ab0e890374904ad94551c76aec4",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "savagefb_check_var",
"file": "drivers/video/fbdev/savage/savagefb_driver.c"
},
"id": "CVE-2024-26778-a8f2d4d1",
"signature_type": "Function",
"digest": {
"length": 2597.0,
"function_hash": "20462788293594373736141515580883780979"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bc3c2e58d73b28b9a8789fca84778ee165a72d13",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/savage/savagefb_driver.c"
},
"id": "CVE-2024-26778-b348f40b",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"57616490291304127224159957492176507860",
"321449740823879040518581021431963005359",
"206085287443723135579604465457228019743"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@070398d32c5f3ab0e890374904ad94551c76aec4",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/savage/savagefb_driver.c"
},
"id": "CVE-2024-26778-c78cc386",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"57616490291304127224159957492176507860",
"321449740823879040518581021431963005359",
"206085287443723135579604465457228019743"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c54acf33e5adaad6374bf3ec1e3aff0591cc8e1",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/savage/savagefb_driver.c"
},
"id": "CVE-2024-26778-ce1def24",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"57616490291304127224159957492176507860",
"321449740823879040518581021431963005359",
"206085287443723135579604465457228019743"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@84dce0f6a4cc5b7bfd7242ef9290db8ac1dd77ff",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/savage/savagefb_driver.c"
},
"id": "CVE-2024-26778-d7a33707",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"57616490291304127224159957492176507860",
"321449740823879040518581021431963005359",
"206085287443723135579604465457228019743"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c54acf33e5adaad6374bf3ec1e3aff0591cc8e1",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "savagefb_check_var",
"file": "drivers/video/fbdev/savage/savagefb_driver.c"
},
"id": "CVE-2024-26778-e482e92c",
"signature_type": "Function",
"digest": {
"length": 2597.0,
"function_hash": "20462788293594373736141515580883780979"
}
}
]