Acknowledged
Created: Jun 18, 2025
Updated: Sep 4, 2026
Resolved Date: Jun 19, 2025
Found In Version: 10.25.33.1
Severity: Standard
Applicable for: Wind River Linux LTS 25
Component/s: Kernel
In the Linux kernel, the following vulnerability has been resolved:EOL][EOL]video: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock()[EOL][EOL]Since the user can control the arguments of the ioctl() from the user[EOL]space, under special arguments that may result in a divide-by-zero bug[EOL]in:[EOL] drivers/video/fbdev/arkfb.c:784: ark_set_pixclock(info, (hdiv * info->var.pixclock) / hmul);[EOL]with hdiv=1, pixclock=1 and hmul=2 you end up with (1*1)/2 = (int) 0.[EOL]and then in:[EOL] drivers/video/fbdev/arkfb.c:504: rv = dac_set_freq(par->dac, 0, 1000000000 / pixclock);[EOL]we'll get a division-by-zero.[EOL][EOL]The following log can reveal it:[EOL][EOL]divide error: 0000 [#1] PREEMPT SMP KASAN PTI[EOL]RIP: 0010:ark_set_pixclock drivers/video/fbdev/arkfb.c:504 [inline][EOL]RIP: 0010:arkfb_set_par+0x10fc/0x24c0 drivers/video/fbdev/arkfb.c:784[EOL]Call Trace:[EOL] fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1034[EOL] do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110[EOL] fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189[EOL][EOL]Fix this by checking the argument of ark_set_pixclock() first.
CREATE(Triage):(User=lchen-cn) [CVE-2022-50102 (https://nvd.nist.gov/vuln/detail/CVE-2022-50102)
