Medium severity · published Aug 26, 2024
CVE-2024-43889
padata: Fix possible divide-by-0 panic in padata_mt_helper()
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved:
padata: Fix possible divide-by-0 panic in padata_mt_helper()
We are hit with a not easily reproducible divide-by-0 panic in padata.c at
bootup time.
[ 10.017908] Oops: divide error: 0000 1 PREEMPT SMP NOPTI
[ 10.017908] CPU: 26 PID: 2627 Comm: kworker/u1666:1 Not tainted 6.10.0-15.el10.x86_64 #1
[ 10.017908] Hardware name: Lenovo ThinkSystem SR950 [7X12CTO1WW]/[7X12CTO1WW], BIOS [PSE140J-2.30] 07/20/2021
[ 10.017908] Workqueue: events_unbound padata_mt_helper
[ 10.017908] RIP: 0010:padata_mt_helper+0x39/0xb0
:
[ 10.017963] Call Trace:
[ 10.017968] <TASK>
[ 10.018004] ? padata_mt_helper+0x39/0xb0
[ 10.018084] process_one_work+0x174/0x330
[ 10.018093] worker_thread+0x266/0x3a0
[ 10.018111] kthread+0xcf/0x100
[ 10.018124] ret_from_fork+0x31/0x50
[ 10.018138] ret_from_fork_asm+0x1a/0x30
[ 10.018147] </TASK>
Looking at the padata_mt_helper() function, the only way a divide-by-0
panic can happen is when ps->chunk_size is 0. The way that chunk_size is
initialized in padata_do_multithreaded(), chunk_size can be 0 when the
min_chunk in the passed-in padata_mt_job structure is 0.
Fix this divide-by-0 panic by making sure that chunk_size will be at least
1 no matter what the input parameters are.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
5.8 before 5.10.224; 5.11 before 5.15.165; 5.16 before 6.1.105; 6.2 before 6.6.46; 6.7 before 6.10.5; 6.11; +1 more · source: NVD
LI
Linux · Linux
004ed42638f4428e70ead59d170f3d17ff761a0f before ab8b397d5997d8c37610252528edc54bebf9f6d3; 004ed42638f4428e70ead59d170f3d17ff761a0f before 8f5ffd2af7274853ff91d6cd62541191d9fbd10d; 004ed42638f4428e70ead59d170f3d17ff761a0f before a29cfcb848c31f22b4de6a531c3e1d68c9bfe09f; 004ed42638f4428e70ead59d170f3d17ff761a0f before 924f788c906dccaca30acab86c7124371e1d6f2c; 004ed42638f4428e70ead59d170f3d17ff761a0f before da0ffe84fcc1627a7dff82c80b823b94236af905; 004ed42638f4428e70ead59d170f3d17ff761a0f before 6d45e1c948a8b7ed6ceddb14319af69424db730c; +1 more · source: vendor
RR
RUGGEDCOM RST2428P · Siemens
before V3.1 · source: CISA
SX
SCALANCE XCM-/XRM-/XCH-/XRH-300 family · Siemens
before V3.1 · source: CISA
SS
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem · Siemens
before V1.1.1 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-43889
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-43889
Patch
https://git.kernel.org/stable/c/6d45e1c948a8b7ed6ceddb14319af69424db730c
Patch
https://git.kernel.org/stable/c/8f5ffd2af7274853ff91d6cd62541191d9fbd10d
Patch
https://git.kernel.org/stable/c/924f788c906dccaca30acab86c7124371e1d6f2c
Patch
https://git.kernel.org/stable/c/a29cfcb848c31f22b4de6a531c3e1d68c9bfe09f
Patch
https://git.kernel.org/stable/c/ab8b397d5997d8c37610252528edc54bebf9f6d3
Patch
https://git.kernel.org/stable/c/da0ffe84fcc1627a7dff82c80b823b94236af905
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability
