Double Free Vulnerability in Linux Kernel - Affects Debian Packages
Summary
DEBIAN-CVE-2024-38627: In the Linux kernel, the following vulnerability has been resolved: stm class: Fix a double free in stm_register_device() The put_device(&stm->dev) call will trigger stm_device_release() which frees "stm" so the vfree(st... Affects linux versions < 5.10.221-1. Fixed in 5.10.221-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It is a critical piece of software that ensures system stability and performance. The kernel is modular, allowing for various functionalities to be added or removed as needed. However, like any complex software, it is susceptible to vulnerabilities that can compromise system security and integrity. This specific vulnerability affects multiple Debian versions of the Linux kernel, highlighting the importance of regular updates and security patches.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the stm class, specifically in the function stm_register_device(). The issue arises from a double free error where the call to put_device(&stm->dev) triggers stm_device_release(), which frees the 'stm' structure. Consequently, the subsequent call to vfree(stm) results in a double free, potentially leading to memory corruption and system instability. This vulnerability can be exploited by attackers to execute arbitrary code or crash the system, posing significant risks to data integrity and availability.
How To Fix
Minimum fixed version
5.10.221-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patches as soon as possible.
Conclusion
The identified double free vulnerability in the Linux kernel poses significant risks to Debian systems. It is crucial for users to update their kernel packages to the patched versions to mitigate these risks. Regular updates and monitoring for vulnerabilities are essential practices for maintaining system security.
See every vulnerability recorded for linux →
FAQ
A double free vulnerability occurs when a program attempts to free the same memory location more than once, which can lead to memory corruption and unpredictable behavior.
Exploitation of this vulnerability can lead to system crashes, arbitrary code execution, or data corruption, compromising the overall security and stability of the system.
If you are using Debian versions 11, 12, 13, or 14 with the Linux kernel, your system may be affected. You can check for vulnerabilities using Vulert without needing to install any software.
It is recommended to regularly check for updates and apply them promptly to ensure your system is protected against known vulnerabilities.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in your software using a manifest file. You can check if your application is affected by vulnerabilities like this one using the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
