CVE-2024-35925

What it actually does

Division by zero in blk_rq_stat_sum() when dst->nr_samples + src->nr_samples overflows to zero, causing kernel panic or denial of service.

Why it matters to the business

Local users on affected Linux systems can trigger system crashes, leading to unplanned downtime and potential data loss on block I/O workloads; high prevalence in cloud and server environments increases operational risk despite low exploit likelihood.

How an attack unfolds

An attacker with local access crafts block I/O patterns that cause nr_samples overflow during statistics summation in the kernel block layer, resulting in a divide-by-zero exception and system crash. No known threat actors have exploited this in the wild.

How to fix it

Upgrade linux-aws-5.4 to version 5.4.0-1135.145~18.04.1 or later on Ubuntu Pro 18.04 LTS systems. Reboot after installation to load the patched kernel.

How to confirm the fix worked

Verify installed kernel version matches or exceeds the fixed release using uname -r; test block I/O workloads that previously triggered the condition to confirm absence of panic.

Typical attack path

1. Obtain local user access on an affected Linux system
2. Perform repeated block device I/O operations to accumulate nr_samples
3. Trigger overflow condition in dst->nr_samples + src->nr_samples
4. Invoke blk_rq_stat_sum() causing division by zero and kernel panic

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for division by zero faults or panics referencing blk_rq_stat_sum or block request statistics; correlate with local user activity on block devices.

What your security team should do

• Prioritize patching affected Ubuntu Pro systems within standard maintenance windows given low EPSS and no KEV listing
• Monitor kernel logs for division-by-zero oops related to blk_rq_stat_sum
• Restrict local access to block device interfaces where feasible until patched