Critical Vulnerability in Linux Kernel: s390/uv Folio Reference Issue
Summary
CVE-2024-43832: In the Linux kernel, the following vulnerability has been resolved: s390/uv: Don't call folio_wait_writeback() without a folio reference folio_wait_writeback() requires that no spinlocks are held and that a folio referen... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management, process control, and system security. It is widely used across various distributions, including Debian. The kernel's stability and security are paramount, as vulnerabilities can lead to severe system compromises. This specific vulnerability affects the s390 architecture, where improper handling of folio references can lead to concurrent access issues, potentially resulting in system instability or crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the s390/uv subsystem. The function folio_wait_writeback() is called without ensuring that a folio reference is held, which violates the function's requirements. This oversight can lead to a situation where the folio is freed while still being accessed, causing undefined behavior and potential system crashes. The vulnerability arises from the dropping of the Page Table Lock (PTL) before acquiring a folio reference, allowing for concurrent freeing of the folio.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the kernel update as soon as it is available.
Conclusion
The CVE-2024-43832 vulnerability in the Linux kernel poses significant risks to systems using the s390 architecture. It is essential for users to stay informed about such vulnerabilities and apply the necessary updates to ensure system security and stability. Regular monitoring with tools like Vulert can help in identifying and addressing vulnerabilities promptly.
See every vulnerability recorded for linux →
FAQ
CVE-2024-43832 is a vulnerability in the Linux kernel affecting the s390 architecture, where improper handling of folio references can lead to system instability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could lead to system crashes, data loss, or unauthorized access, compromising the integrity and availability of the system.
Yes, patches are available in the latest kernel updates for Debian 12 and 13. Users should upgrade to versions 6.1.106-1 and 6.10.3-1, respectively.
While there are no specific workarounds, it is crucial to prioritize updating your kernel to mitigate the risks associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
