Executive brief
A vulnerability exists in the Linux kernel's block layer, which manages how data is read from and written to storage devices. Under specific conditions involving high volumes of data samples, the system may attempt to perform a mathematical operation (division by zero) that causes the operating system to crash. This could allow a local user to disrupt system availability, potentially leading to a denial-of-service.
Technical details
A division by zero vulnerability (CWE-369) exists in the blk_rq_stat_sum() function within block/blk-stat.c of the Linux kernel. The vulnerability is caused by an integer overflow when summing 'nr_samples' from source and destination structures; if the sum overflows to zero, subsequent calculations result in a division by zero. A local attacker with basic privileges could potentially trigger this condition to cause a kernel panic (Denial of Service). The issue has been resolved by adding a check to detect when the combined sample count would overflow or result in zero. Patch commits have been released for multiple stable branches including 4.19, 5.4, 5.10, 5.15, 6.1, 6.6, and 6.8.
Affected products
- Linux Linux Kernel up to 4.19.312, 4.20 to 5.4.274, 5.5 to 5.10.215, 5.11 to 5.15.155, 5.16 to 6.1.86, 6.2 to 6.6.27, 6.7 to 6.8.6
Timeline
- 2024-05-19: advisory: Initial disclosure and publication
- 2024-04-13: patched: Fixes committed to various stable kernel branches
References
- https://git.kernel.org/stable/c/21e7d72d0cfcbae6042d498ea2e6f395311767f8
- https://git.kernel.org/stable/c/512a01da7134bac8f8b373506011e8aaa3283854
- https://git.kernel.org/stable/c/5f7fd6aa4c4877d77133ea86c14cf256f390b2fe
- https://git.kernel.org/stable/c/6a55dab4ac956deb23690eedd74e70b892a378e7
- https://git.kernel.org/stable/c/93f52fbeaf4b676b21acfe42a5152620e6770d02
- https://git.kernel.org/stable/c/98ddf2604ade2d954bf5ec193600d5274a43fd68
- https://git.kernel.org/stable/c/b0cb5564c3e8e0ee0a2d28c86fa7f02e82d64c3c