{
  "threat_severity" : "Moderate",
  "public_date" : "2024-08-26T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: padata: Fix possible divide-by-0 panic in padata_mt_helper()",
    "id" : "2307862",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2307862"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-369",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\npadata: Fix possible divide-by-0 panic in padata_mt_helper()\nWe are hit with a not easily reproducible divide-by-0 panic in padata.c at\nbootup time.\n[   10.017908] Oops: divide error: 0000 1 PREEMPT SMP NOPTI\n[   10.017908] CPU: 26 PID: 2627 Comm: kworker/u1666:1 Not tainted 6.10.0-15.el10.x86_64 #1\n[   10.017908] Hardware name: Lenovo ThinkSystem SR950 [7X12CTO1WW]/[7X12CTO1WW], BIOS [PSE140J-2.30] 07/20/2021\n[   10.017908] Workqueue: events_unbound padata_mt_helper\n[   10.017908] RIP: 0010:padata_mt_helper+0x39/0xb0\n:\n[   10.017963] Call Trace:\n[   10.017968]  <TASK>\n[   10.018004]  ? padata_mt_helper+0x39/0xb0\n[   10.018084]  process_one_work+0x174/0x330\n[   10.018093]  worker_thread+0x266/0x3a0\n[   10.018111]  kthread+0xcf/0x100\n[   10.018124]  ret_from_fork+0x31/0x50\n[   10.018138]  ret_from_fork_asm+0x1a/0x30\n[   10.018147]  </TASK>\nLooking at the padata_mt_helper() function, the only way a divide-by-0\npanic can happen is when ps->chunk_size is 0.  The way that chunk_size is\ninitialized in padata_do_multithreaded(), chunk_size can be 0 when the\nmin_chunk in the passed-in padata_mt_job structure is 0.\nFix this divide-by-0 panic by making sure that chunk_size will be at least\n1 no matter what the input parameters are.", "A denial of service vulnerability exists in the Linux kernel. A possible divide-by-0 is in the padata_mt_helper() function when the ps->chunk_size is 0. This vulnerability could result in a loss of system availability." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2024-11-05T00:00:00Z",
    "advisory" : "RHSA-2024:8870",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8::nfv",
    "package" : "kernel-rt-0:4.18.0-553.27.1.rt7.368.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2024-11-05T00:00:00Z",
    "advisory" : "RHSA-2024:8856",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "kernel-0:4.18.0-553.27.1.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2025-05-13T00:00:00Z",
    "advisory" : "RHSA-2025:6966",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-570.12.1.el9_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2025-05-13T00:00:00Z",
    "advisory" : "RHSA-2025:6966",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-570.12.1.el9_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.4 Extended Update Support",
    "release_date" : "2025-03-05T00:00:00Z",
    "advisory" : "RHSA-2025:2270",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.4",
    "package" : "kernel-0:5.14.0-427.57.1.el9_4"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Will not fix",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2024-43889\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-43889\nhttps://lore.kernel.org/linux-cve-announce/2024082600-CVE-2024-43889-4d0b@gregkh/T" ],
  "name" : "CVE-2024-43889",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}