Critical Use-After-Free Vulnerability in Linux Kernel Packages
Summary
DEBIAN-CVE-2024-39502: In the Linux kernel, the following vulnerability has been resolved: ionic: fix use after netif_napi_del() When queues are started, netif_napi_add() and napi_enable() are called. Affects linux versions < 5.10.221-1. Fixed in 5.10.221-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It is widely used in various distributions, including Debian, which is known for its stability and security. The kernel's functionality includes process management, memory management, device drivers, and system calls. However, vulnerabilities in the kernel can lead to severe security risks, including system crashes and unauthorized access.
Vulnerability Detail
In the Linux kernel, a use-after-free vulnerability has been identified in the ionic driver. This issue arises when the netif_napi_del() function is called, but the .poll pointer is not reset to NULL, leading to potential exploitation. When queues are started, the ionic_qcq_enable() function may incorrectly enable a queue that has been unregistered, resulting in a kernel crash. This vulnerability can be triggered by specific network configurations, posing a risk of denial-of-service attacks and system instability.
How To Fix
Minimum fixed version
5.10.221-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected network configurations that trigger the vulnerability until the kernel is updated. This may involve disabling certain network queues or reverting to previous configurations that do not utilize the ionic driver.
Conclusion
The identified use-after-free vulnerability in the Linux kernel poses significant risks to system stability and security. It is crucial for users to update their kernel packages to the latest patched versions to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor for vulnerabilities in real-time, ensuring ongoing security.
See every vulnerability recorded for linux →
FAQ
A use-after-free vulnerability occurs when a program continues to use a memory location after it has been freed, potentially leading to crashes or arbitrary code execution.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
Exploitation of this vulnerability can lead to system crashes, denial-of-service attacks, and unauthorized access to sensitive data.
Yes, updating to the patched versions (5.10.221-1 for Debian 11, 6.1.99-1 for Debian 12, and 6.9.7-1 for Debian 13 and 14) will mitigate the vulnerability.
If immediate updates are not possible, consider applying the suggested workarounds, such as avoiding specific network configurations that trigger the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
