CVE-2024-35904: linux-libc-dev - Kernel SELinux Dereference of Garbage After Mount Failure
Summary
CVE-2024-35904: In the Linux kernel, the following vulnerability has been resolved: selinux: avoid dereference of garbage after mount failure In case kern_mount() fails and returns an error pointer return in the error branch instead of... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
linux-libc-dev is a package that provides the C library for use with the Linux kernel. It contains the necessary header files and libraries for compiling and linking programs that use the standard C library. The package is an essential component for building and running applications on Linux systems. However, a vulnerability has been discovered in the package related to SELinux, which is a security module for the Linux kernel. This vulnerability can lead to the dereference of garbage data after a mount failure, potentially resulting in security issues and system instability.
Vulnerability Detail
The vulnerability in linux-libc-dev arises from a flaw in the SELinux implementation. When the kern_mount() function fails and returns an error pointer, the code continues execution and dereferences the error pointer, leading to potential issues. This vulnerability can be exploited by an attacker to gain unauthorized access, escalate privileges, or cause denial of service. The static variable selinuxfs_mount, which was never read, has also been removed as part of the fix for this vulnerability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring they have updated to the latest version of the linux-libc-dev package.
Conclusion
The linux-libc-dev package is vulnerable to a flaw in the SELinux implementation, which can result in the dereference of garbage data after a mount failure. To mitigate the risk, it is crucial to update the package to version 6.1.90-1 or later. Restarting the affected system after the update is recommended. For further assistance or information on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
linux-libc-dev is a package that provides the C library for use with the Linux kernel. It contains the necessary header files and libraries for compiling and linking programs that use the standard C library.
SELinux is a security module for the Linux kernel that provides mandatory access control (MAC) mechanisms. It enhances the security of Linux systems by enforcing fine-grained access policies and preventing unauthorized actions.
This vulnerability can be exploited by an attacker to gain unauthorized access, escalate privileges, or cause denial of service. It may lead to security breaches, data loss, or system instability.
You can update the linux-libc-dev package by using the package manager of your Linux distribution or by manually downloading and installing the updated package from a trusted source.
Yes, the CVSS score for this vulnerability is 5.5, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
