CVE-2024-35925

block: prevent division by zero in blk_rq_stat_sum()

Severity Score

5.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

In the Linux kernel, the following vulnerability has been resolved:

block: prevent division by zero in blk_rq_stat_sum()

The expression dst->nr_samples + src->nr_samples may
have zero value on overflow. It is necessary to add
a check to avoid division by zero.

Found by Linux Verification Center (linuxtesting.org) with Svace.

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bloquear: evitar la división por cero en blk_rq_stat_sum() La expresión dst->nr_samples + src->nr_samples puede tener un valor cero en caso de desbordamiento. Es necesario agregar un cheque para evitar la división por cero. Encontrado por el Centro de verificación de Linux (linuxtesting.org) con Svace.

*Credits: N/A

CVSS Scores

Red Hatv3.1 5.5

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-05-17 CVE Reserved
2024-05-19 CVE Published
2024-05-20 EPSS Updated
2024-11-05 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (12)

URL	Tag	Source
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html

URL	Date	SRC

URL	Date	SRC
https://git.kernel.org/stable/c/6a55dab4ac956deb23690eedd74e70b892a378e7	2024-04-13
https://git.kernel.org/stable/c/edd073c78d2bf48c5b8bf435bbc3d61d6e7c6c14	2024-04-13
https://git.kernel.org/stable/c/b0cb5564c3e8e0ee0a2d28c86fa7f02e82d64c3c	2024-04-13
https://git.kernel.org/stable/c/21e7d72d0cfcbae6042d498ea2e6f395311767f8	2024-04-13
https://git.kernel.org/stable/c/512a01da7134bac8f8b373506011e8aaa3283854	2024-04-13
https://git.kernel.org/stable/c/5f7fd6aa4c4877d77133ea86c14cf256f390b2fe	2024-04-13
https://git.kernel.org/stable/c/98ddf2604ade2d954bf5ec193600d5274a43fd68	2024-04-13
https://git.kernel.org/stable/c/93f52fbeaf4b676b21acfe42a5152620e6770d02	2024-03-06

URL	Date	SRC
https://access.redhat.com/security/cve/CVE-2024-35925	2024-11-12
https://bugzilla.redhat.com/show_bug.cgi?id=2281752	2024-11-12

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 4.19.312 Search vendor "Linux" for product "Linux Kernel" and version " < 4.19.312"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 5.4.274 Search vendor "Linux" for product "Linux Kernel" and version " < 5.4.274"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 5.10.215 Search vendor "Linux" for product "Linux Kernel" and version " < 5.10.215"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 5.15.155 Search vendor "Linux" for product "Linux Kernel" and version " < 5.15.155"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 6.1.86 Search vendor "Linux" for product "Linux Kernel" and version " < 6.1.86"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 6.6.27 Search vendor "Linux" for product "Linux Kernel" and version " < 6.6.27"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 6.8.6 Search vendor "Linux" for product "Linux Kernel" and version " < 6.8.6"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 6.9 Search vendor "Linux" for product "Linux Kernel" and version " < 6.9"		en		Affected