CVE-2024-26777
fbdev: sis: Error out if pixclock equals zero
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
03 Apr 2024Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
In the Linux kernel, the following vulnerability has been resolved:
fbdev: sis: Error out if pixclock equals zero
The userspace program could pass any values to the driver through
ioctl() interface. If the driver doesn't check the value of pixclock,
it may cause divide-by-zero error.
In sisfb_check_var(), var->pixclock is used as a divisor to caculate
drate before it is checked against zero. Fix this by checking it
at the beginning.
This is similar to CVE-2022-3061 in i740fb which was fixed by
commit 15cf0b8.
Affected products
Linux · LinuxReferences
https://git.kernel.org/stable/c/1d11dd3ea5d039c7da089f309f39c4cd363b924bhttps://git.kernel.org/stable/c/6db07619d173765bd8622d63809cbfe361f04207https://git.kernel.org/stable/c/84246c35ca34207114055a87552a1c4289c8fd7ehttps://git.kernel.org/stable/c/99f1abc34a6dde248d2219d64aa493c76bbdd9ebhttps://git.kernel.org/stable/c/cd36da760bd1f78c63c7078407baf01dd724f313https://git.kernel.org/stable/c/df6e2088c6f4cad539cf67cba2d6764461e798d1https://git.kernel.org/stable/c/e421946be7d9bf545147bea8419ef8239cb7ca52https://git.kernel.org/stable/c/f329523f6a65c3bbce913ad35473d83a319d5d99https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlhttps://lists.debian.org/debian-lts-announce/2024/06/msg00020.html