CVE-2019-14284: Divide by Zero
In the Linux kernel before 5.2.3, drivers/block/floppy.c allows a denial of service by setupformatparams division-by-zero. Two consecutive ioctls can trigger the bug: the first one should set the drive geometry with .sect and .rate values that make FSECTPERTRACK be zero. Next, the floppy format operation should be called. It can be triggered by an unprivileged local user even when a floppy disk has not been inserted. NOTE: QEMU creates the floppy device by default.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.187-1Fixed in 6.12.107-1Fixed in 6.12.111-1Fixed in 7.2.9-1Fixed in 7.2.10-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 5.2.3
Event History
Frequently Asked Questions
What is the severity of CVE-2019-14284?
CVE-2019-14284 has a severity rating that allows for denial of service vulnerabilities in the Linux kernel, which can cause system crashes.
How do I fix CVE-2019-14284?
To fix CVE-2019-14284, upgrade to a Linux kernel version 5.2.3 or later.
What are the affected versions for CVE-2019-14284?
CVE-2019-14284 affects versions of the Linux kernel prior to 5.2.3.
What type of vulnerability is CVE-2019-14284?
CVE-2019-14284 is a denial of service vulnerability caused by a division-by-zero error in the Linux kernel.
Which Linux distributions are affected by CVE-2019-14284?
CVE-2019-14284 affects various Linux distributions utilizing the vulnerable versions of the Linux kernel prior to 5.2.3.