Kernel Vulnerability in Linux Package: Netdevsim PHC Destruction Issue
Summary
DEBIAN-CVE-2024-26587: In the Linux kernel, the following vulnerability has been resolved: net: netdevsim: don't try to destroy PHC on VFs PHC gets initialized in nsim_init_netdevsim(), which is only called if (nsim_dev_port_is_pf()). Affects linux versions < 6.6.15-1. Fixed in 6.6.15-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It is widely used in various environments, from servers to embedded systems. This vulnerability specifically affects the netdevsim module, which simulates network devices for testing purposes. The issue arises when attempting to destroy a Precision Time Protocol Hardware Clock (PHC) associated with virtual functions (VFs), leading to potential system crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the netdevsim module where the system attempts to destroy a PHC when virtual functions are instantiated. This occurs due to a NULL pointer dereference, which can lead to a crash. The vulnerability was introduced in the initialization process of the netdevsim and can be triggered during the execution of specific tests, such as devlink.sh. The crash manifests as a kernel NULL pointer dereference error, indicating a serious flaw that can compromise system stability.
How To Fix
Minimum fixed version
6.6.15-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, avoiding the use of netdevsim with instantiated VFs may prevent the crash until the package is updated.
Conclusion
The vulnerability identified in the Linux kernel's netdevsim module poses a significant risk of system crashes when handling PHC destruction with virtual functions. It is crucial for users to update to the patched version 6.6.15-1 or later to ensure system stability and security. Regular monitoring for vulnerabilities using tools like Vulert can help maintain a secure environment.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes when attempting to destroy netdevsim with instantiated virtual functions, resulting in potential downtime.
You can use Vulert, which monitors open-source vulnerabilities in your software. By utilizing the Vulert playground, you can check if your application is affected without any signup.
The vulnerability affects all versions prior to 6.6.15-1 in Debian 13 and 14.
While the primary risk is system instability and crashes, it is advisable to ensure data is backed up regularly to mitigate any potential loss.
If an immediate update is not possible, consider avoiding the use of netdevsim with instantiated VFs to prevent triggering the crash.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
