Kernel Crash Vulnerability in Linux Package: PCI Hotplug Driver Issue
Summary
CVE-2024-46761: In the Linux kernel, the following vulnerability has been resolved: pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv The hotplug driver for powerpc (pci/hotplug/pnv_php.c) causes a kernel crash when we try to hot... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It supports various architectures, including PowerPC, and includes drivers for hardware components. The PCI hotplug driver for PowerPC, specifically located in pci/hotplug/pnv_php.c, is designed to manage the dynamic addition and removal of PCI devices. However, it has been found to have a critical vulnerability that can lead to kernel crashes when attempting to hot-unplug or disable PCIe switches or bridges.
Vulnerability Detail
The vulnerability arises from a NULL pointer dereference during the unregistration process of the PCI hotplug driver. When a PCIe switch or bridge is hot-unplugged, the MSI data structure is released and set to NULL. However, the driver still attempts to disable the MSI, leading to a crash due to the dereference of a NULL pointer. This issue can cause system instability and crashes, impacting the reliability of systems that rely on this functionality.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid hot-unplugging or disabling PCIe switches or bridges until the patch is applied. This will prevent the kernel crash from occurring.
Conclusion
The CVE-2024-46761 vulnerability in the Linux kernel's PCI hotplug driver poses a significant risk of kernel crashes when hot-unplugging PCIe devices. Users are advised to apply the provided patch to ensure system stability and prevent potential crashes. Temporary workarounds are available, but updating the system is the recommended solution.
See every vulnerability recorded for linux →
FAQ
CVE-2024-46761 is a vulnerability in the Linux kernel's PCI hotplug driver for PowerPC that can cause kernel crashes when attempting to hot-unplug PCIe devices.
This vulnerability can lead to system instability and crashes, particularly in environments that utilize PCI hotplug functionality.
The vulnerability affects the Linux packages in Debian 11, 12, and 13.
Yes, a patch has been released and users are encouraged to update their Linux packages to resolve the issue.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
