CVE-2022-3061

What it actually does

The i740 kernel driver performs no validation on the pixclock value supplied via ioctl from userspace, allowing a zero value that triggers an unhandled integer divide-by-zero exception and subsequent kernel panic.

Why it matters to the business

Systems using legacy i740 graphics hardware can experience sudden kernel crashes and reboots, causing unplanned downtime for any workloads or services running on those machines; prevalence is low because the hardware is obsolete.

How an attack unfolds

A local attacker compiles or executes a small program that opens the i740 device node and issues an ioctl with pixclock set to zero; the driver divides by this value, the kernel faults, and the system becomes unavailable.

How to fix it

Upgrade to a Linux kernel that contains the input-validation fix for the i740 driver; if no newer packaged kernel is available, disable the i740 driver module or replace the affected hardware.

How to confirm the fix worked

Inspect the i740 driver source for an explicit range or non-zero check on pixclock before any division; attempt the ioctl from a test program on a non-production system and confirm the kernel no longer panics.

Typical attack path

1. Obtain a local shell or user context on the target host
2. Locate the i740 character device node
3. Invoke ioctl with a crafted pixclock value of zero
4. Trigger kernel exception and denial of service

How to detect it

Search kernel logs and crash dumps for oops/panic messages containing divide-by-zero and i740; correlate with processes that recently opened the i740 device node.

• divide by zero
• i740
• pixclock

What your security team should do

• Inventory hosts that still load the i740 driver
• Apply the latest available kernel packages containing the validation fix
• Restrict local user access on any remaining legacy systems until patched
• Monitor kernel logs for divide-by-zero faults referencing i740