CVE-2022-50102
BaseFortify
Publication date: 2025-06-18
Last updated on: 2025-11-19
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-369 | The product divides a value by zero. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a divide-by-zero bug in the Linux kernel's arkfb framebuffer driver. It occurs because user-controlled arguments passed via the ioctl() system call can lead to a division by zero in the function ark_set_pixclock(). Specifically, under certain argument values, a calculation results in zero, which is then used as a divisor, causing a divide error and potentially crashing the kernel. The issue is fixed by validating the arguments before performing the division.
How can this vulnerability impact me? :
This vulnerability can cause a kernel crash due to a divide-by-zero error when the vulnerable function is called with specially crafted arguments. This can lead to system instability or denial of service, as the kernel may panic or become unresponsive.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring system logs for the specific divide-by-zero error messages related to ark_set_pixclock. Look for kernel log entries containing 'divide error' and references to 'ark_set_pixclock' or 'arkfb_set_par'. For example, you can use the command: dmesg | grep -i 'divide error' or journalctl -k | grep -i 'ark_set_pixclock'.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where the ark_set_pixclock() function includes proper argument checks to prevent divide-by-zero errors. Until then, avoid using or exposing the vulnerable ioctl() interface with user-controlled arguments that could trigger this bug.