Description
In the Linux kernel, the following vulnerability has been resolved: comedi: fix divide-by-zero in comedi_buf_munge() The comedi_buf_munge() function performs a modulo operation `async->munge_chan %= async->cmd.chanlist_len` without first checking if chanlist_len is zero. If a user program submits a command with chanlist_len set to zero, this causes a divide-by-zero error when the device processes data in the interrupt handler path. Add a check for zero chanlist_len at the beginning of the function, similar to the existing checks for !map and CMDF_RAWDATA flag. When chanlist_len is zero, update munge_count and return early, indicating the data was handled without munging. This prevents potential kernel panics from malformed user commands.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
ed9eccbe8970f6eedc1b978c157caf1251a896d4 to < 4ffea48c69cb2b96a281cb7e5e42d706996631dbaffecteded9eccbe8970f6eedc1b978c157caf1251a896d4 to < 8f3e4cd9be4b47246ea73ce5e3e0fa2f57f0d10caffecteded9eccbe8970f6eedc1b978c157caf1251a896d4 to < 2670932f2465793fea1ef073e40883e8390fa4d9affecteded9eccbe8970f6eedc1b978c157caf1251a896d4 to < 6db19822512396be1a3e1e20c16c97270285ba1aaffecteded9eccbe8970f6eedc1b978c157caf1251a896d4 to < d4854eff25efb06d0d84c13e7129bbdba4125f8caffecteded9eccbe8970f6eedc1b978c157caf1251a896d4 to < a4bb5d1bc2f238461bcbe5303eb500466690bb2caffecteded9eccbe8970f6eedc1b978c157caf1251a896d4 to < 55520f65fd447e04099a2c44185453c18ea73b7eaffecteded9eccbe8970f6eedc1b978c157caf1251a896d4 to < 87b318ba81dda2ee7b603f4f6c55e78ec3e95974affected
Linux Linux
Default version status: affected
2.6.29affected0 to < 2.6.29unaffected5.4.301 to ≤ 5.4.*unaffected5.10.246 to ≤ 5.10.*unaffected5.15.196 to ≤ 5.15.*unaffected6.1.158 to ≤ 6.1.*unaffected6.6.115 to ≤ 6.6.*unaffected6.12.56 to ≤ 6.12.*unaffected6.17.6 to ≤ 6.17.*unaffected6.18 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/4ffea48c69cb2b96a281cb7e5e42d706996631db ↗
- https://git.kernel.org/stable/c/8f3e4cd9be4b47246ea73ce5e3e0fa2f57f0d10c ↗
- https://git.kernel.org/stable/c/2670932f2465793fea1ef073e40883e8390fa4d9 ↗
- https://git.kernel.org/stable/c/6db19822512396be1a3e1e20c16c97270285ba1a ↗
- https://git.kernel.org/stable/c/d4854eff25efb06d0d84c13e7129bbdba4125f8c ↗
- https://git.kernel.org/stable/c/a4bb5d1bc2f238461bcbe5303eb500466690bb2c ↗
- https://git.kernel.org/stable/c/55520f65fd447e04099a2c44185453c18ea73b7e ↗
- https://git.kernel.org/stable/c/87b318ba81dda2ee7b603f4f6c55e78ec3e95974 ↗