CVE-2024-27062: linux-libc-dev - kernel: nouveau: lock the client object tree
Summary
CVE-2024-27062: In the Linux kernel, the following vulnerability has been resolved: nouveau: lock the client object tree. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
linux-libc-dev is a package that provides the Linux kernel headers for development. It is used to compile and build software that interacts with the Linux kernel. The package contains various header files and libraries necessary for developing kernel modules and other low-level software. This vulnerability affects the linux-libc-dev package and specifically the nouveau driver, which is responsible for managing NVIDIA graphics cards. The vulnerability allows for race conditions when adding or removing client objects, particularly vram bar mappings.
Vulnerability Detail
The vulnerability in the linux-libc-dev package arises from the lack of locking in the client object tree. This can lead to general protection faults and potential exploitation by an attacker. The issue has been addressed in the Linux kernel. The vulnerability has a CVSS score of 5.5, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The linux-libc-dev package, specifically the nouveau driver, is vulnerable to a race condition issue. This can lead to general protection faults and potential exploitation. It is crucial to update the linux-libc-dev package to version 6.1.90-1 or later to mitigate the vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
linux-libc-dev is a package that provides the Linux kernel headers for development. It is used to compile and build software that interacts with the Linux kernel.
The nouveau driver is a component of the Linux kernel responsible for managing NVIDIA graphics cards.
A race condition is a situation where the behavior of a system depends on the relative timing of events, which can lead to unpredictable and potentially harmful outcomes.
A general protection fault is an error that occurs when a program attempts to access memory or perform an operation that it is not allowed to do, resulting in a crash or system instability.
The CVSS score of this vulnerability is 5.5, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
