Kernel Panic Vulnerability in Linux Package: CVE-2024-41048
Summary
CVE-2024-41048: In the Linux kernel, the following vulnerability has been resolved: skmsg: Skip zero length skb in sk_msg_recvmsg When running BPF selftests (./test_progs -t sockmap_basic) on a Loongarch platform, the following kernel p... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and hardware communication. It provides essential services to applications and ensures efficient operation of the system. The kernel is modular, allowing for various functionalities to be added or removed as needed. However, vulnerabilities can arise, such as CVE-2024-41048, which affects the handling of socket messages, specifically on the Loongarch platform.
Vulnerability Detail
CVE-2024-41048 is a vulnerability in the Linux kernel that occurs when a zero-length socket buffer (skb) is processed in the sk_msg_recvmsg function. This situation leads to a NULL pointer being passed to the page_address function, resulting in a kernel panic. The issue is triggered when a TCP FIN packet is sent during a shutdown operation, causing the system to crash. This vulnerability is particularly critical on the Loongarch architecture, where the panic is exposed, while it may remain hidden on other architectures like x86.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid triggering the vulnerability by not executing the sockmap_skb_verdict_shutdown subtest in sockmap_basic until the kernel is updated. This will prevent the kernel panic from occurring during the execution of this specific test.
Conclusion
CVE-2024-41048 is a critical vulnerability in the Linux kernel that can lead to kernel panic on the Loongarch platform due to improper handling of zero-length socket buffers. Users are advised to update their systems to the latest versions to prevent potential crashes and ensure system stability.
See every vulnerability recorded for linux →
FAQ
CVE-2024-41048 is a vulnerability in the Linux kernel that can cause a kernel panic when processing zero-length socket buffers on the Loongarch platform.
If your system is running a vulnerable version of the Linux kernel on a Loongarch platform, it may crash unexpectedly when certain socket operations are performed.
You should update your Linux package to the fixed versions as soon as possible to mitigate the risk of a kernel panic.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
The fixed versions for Debian are 6.1.106-1 for Debian 12 and 6.9.10-1 for Debian 13.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
