Kernel Crash Vulnerability in Linux Packages on Debian Systems
Summary
CVE-2024-42230: In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Fix scv instruction crash with kexec kexec on pseries disables AIL (reloc_on_exc), required for scv instruction support, before other C... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It is widely used across various distributions, including Debian, which is known for its stability and robustness. This vulnerability affects multiple versions of the Linux package on Debian systems, highlighting a critical issue that could lead to system crashes during specific operations.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the handling of the scv instruction during kexec operations on pseries systems. The issue arises because kexec disables the Addressing Instruction List (AIL) before other CPUs are shut down, allowing them to execute scv instructions after AIL is disabled. This can result in an interrupt occurring at an unexpected entry point, ultimately crashing the kernel. The vulnerability is particularly concerning as it can lead to system instability and potential data loss.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the necessary updates as soon as they are available.
Conclusion
The vulnerability identified in the Linux kernel on Debian systems poses a significant risk of kernel crashes during kexec operations. Users are advised to update their Linux packages to the fixed versions to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
The CVSS score of this vulnerability is 4.4, indicating a moderate severity level.
The vulnerability affects Debian 11, Debian 12, and Debian 13 versions of the Linux package.
Kexec is a system call that allows the Linux kernel to load and boot into a new kernel without going through the BIOS. This vulnerability arises during the kexec process on pseries systems.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading your manifest file, such as package-lock.json, you can check for vulnerabilities without requiring installation.
Yes, the kernel crash caused by this vulnerability can lead to system instability and potential data loss.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
