CVE-2024-39475

What it actually does

Unhandled error return from savagefb_check_var in savagefb_probe allows pixclock==0 to reach a divide-by-zero operation inside the savage framebuffer driver.

Why it matters to the business

Local users can trigger a kernel crash or denial of service on systems using the savage framebuffer driver, leading to loss of graphics console and potential system instability until reboot.

How an attack unfolds

An attacker with local access loads or probes the savagefb driver with a zero pixclock value; savagefb_check_var detects the invalid value and returns an error that savagefb_probe ignores, causing an immediate divide-by-zero and kernel oops or panic.

How to fix it

Update the Linux kernel to a fixed release containing commit be754cbd77eaf2932408a4e18532e4945274a5c7 or version 4.19.316 (or later stable backports). Rebuild and reboot with the patched kernel; disable the savagefb driver if the hardware is not required.

How to confirm the fix worked

Verify running kernel version is at or above the listed fixed releases; confirm the patch is present by checking for the error-handling change around savagefb_check_var in savagefb_probe; test with a zero-pixclock scenario in a lab environment to ensure no crash occurs.

Typical attack path

1. Obtain local user or unprivileged process access on an affected Linux system
2. Trigger savagefb_probe (via module load, fbdev open, or graphics initialization) with pixclock set to zero
3. savagefb_check_var returns error that is ignored
4. Divide-by-zero occurs, resulting in kernel fault

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for savagefb-related divide-by-zero or oops messages; look for unexpected module loads of savagefb or fbdev probe failures around the time of any system instability.

What your security team should do

• Apply the kernel update to 4.19.316 or the referenced commit on all affected systems as the primary fix
• Audit systems for savagefb usage and disable the driver where possible via kernel config or blacklist
• Monitor kernel logs for divide-by-zero oops entries related to savagefb until patching is complete