CVE-2024-39475: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-39475 is a vulnerability in the Linux kernel's framebuffer device (fbdev) savage driver, discovered and disclosed on July 5, 2024. The vulnerability affects multiple versions of the Linux kernel, including versions from 4.19 through 6.9, specifically impacting the savage framebuffer driver (NVD).

The vulnerability stems from improper error handling in the savagefb_probe function. While commit 04e5eac8f3ab added a check for zero pixclock values to prevent divide-by-zero errors, the function savagefb_probe failed to handle the error return from savagefb_check_var. When pixclock is set to 0, this oversight can lead to a divide-by-zero error. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can cause a divide-by-zero error in the Linux kernel's savage framebuffer driver, potentially leading to system availability issues. The impact is limited to systems using the savage framebuffer driver, with the potential for local denial of service (NVD).

The vulnerability requires local access and low privileges to exploit. It is triggered when the pixclock value is set to zero in the savage framebuffer driver configuration (NVD).

The vulnerability has been patched in various Linux kernel versions. Ubuntu has released fixes for multiple kernel versions including 5.15.0-121.131 for Ubuntu 22.04 LTS, 5.4.0-192.212 for Ubuntu 20.04 LTS, and other kernel variants. The fix involves properly handling the error return from savagefb_check_var in the savagefb_probe function (Ubuntu).