CVE-2024-35938: linux-libc-dev - Decrease MHI Channel Buffer Length to 8KB
Summary
CVE-2024-35938: In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: decrease MHI channel buffer length to 8KB Currently buf_len field of ath11k_mhi_config_qca6390 is assigned with 0, making MHI use a defaul... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux-libc-dev package is a development package that provides the necessary header files and libraries for compiling C programs against the Linux kernel. It is an essential component for building and running applications on Linux systems. This vulnerability affects the linux-libc-dev package version 6.1.90-1.
Vulnerability Detail
The vulnerability in the linux-libc-dev package arises from the buf_len field of ath11k_mhi_config_qca6390 being assigned a value of 0, causing MHI to use a default size of 64KB to allocate channel buffers. This can lead to allocation failures in scenarios where system memory is highly fragmented and memory compaction or reclaim is not allowed. The issue can result in a page allocation failure, impacting the stability and performance of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is advised to apply the patch provided by the linux-libc-dev package maintainers.
Conclusion
The linux-libc-dev package version 6.1.90-1 is vulnerable to a memory allocation issue that can result in page allocation failures. To mitigate this vulnerability, it is crucial to update the package to a version that includes the fix. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to page allocation failures, potentially causing system instability and performance issues.
The linux-libc-dev package version 6.1.90-1 is affected by this vulnerability.
Yes, a patch has been released to address this vulnerability. It is recommended to update to a version of the linux-libc-dev package that includes the fix.
No, there are no known workarounds for this vulnerability. Applying the provided patch is the recommended solution.
You can find more information about this vulnerability in the references section of the vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
