Critical Vulnerability in Linux Kernel Affecting Debian Packages
Summary
CVE-2024-56787: In the Linux kernel, the following vulnerability has been resolved: soc: imx8m: Probe the SoC driver as platform driver With driver_async_probe=* on kernel command line, the following trace is produced because on i.MX8M... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware and system resources. It provides essential services for all other software running on the system. The kernel is highly modular, allowing for various drivers and subsystems to be loaded dynamically. This vulnerability specifically impacts the i.MX8M Plus hardware, which relies on the soc-imx8m.c driver for proper functionality.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the soc-imx8m.c driver, which fails to properly handle clock driver probing when the driver_async_probe option is enabled. This results in the driver returning an error code (-EPROBE_DEFER) when it attempts to access the clock driver before it has been initialized. The issue was not detected during regular testing, leading to potential system instability and failure to initialize critical hardware components. The vulnerability can cause the system to hang or crash, impacting overall system reliability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the driver_async_probe option in the kernel command line to prevent the issue from occurring until the kernel is updated. This can be done by editing the boot parameters in the bootloader configuration.
Conclusion
The CVE-2024-56787 vulnerability in the Linux kernel poses a significant risk to systems using the soc-imx8m.c driver, particularly on i.MX8M Plus hardware. Users are urged to update their kernel to the patched versions to ensure system stability and security. For those unable to update immediately, a temporary workaround is available.
See every vulnerability recorded for linux →
FAQ
CVE-2024-56787 is a vulnerability in the Linux kernel affecting the soc-imx8m.c driver, which can lead to system instability on i.MX8M Plus hardware.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The vulnerability can cause the system to hang or crash, leading to potential data loss and affecting overall system reliability.
Yes, patched versions of the Linux kernel are available for Debian 12 and Debian 13. Users should update to the specified versions to mitigate the vulnerability.
As a temporary measure, you can disable the driver_async_probe option in the kernel command line to prevent the issue from occurring.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
