Double Free Vulnerability in Linux Kernel Package: linux
Summary
DEBIAN-CVE-2024-26652: In the Linux kernel, the following vulnerability has been resolved: net: pds_core: Fix possible double free in error handling path When auxiliary_device_add() returns error and then calls auxiliary_device_uninit(), Callb... Affects linux versions < 6.7.12-1. Fixed in 6.7.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'linux' package is a core component of the Debian operating system, providing the Linux kernel that manages system resources and hardware interactions. It is essential for the functioning of the operating system, enabling applications to run and communicate with hardware. The kernel is responsible for memory management, process scheduling, and device control, making it a critical element for system stability and security. This specific vulnerability arises from improper error handling in the net subsystem, which could lead to memory corruption and potential system crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the net subsystem related to the pds_core component. The issue occurs when the auxiliary_device_add() function returns an error, leading to a double free scenario in the error handling path. Specifically, the callback function pdsc_auxbus_dev_release attempts to free memory that has already been freed, which can result in memory corruption, crashes, or exploitation by malicious actors. This vulnerability is critical as it can compromise system stability and security, allowing unauthorized access or denial of service.
How To Fix
Minimum fixed version
6.7.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch by updating the package as mentioned above.
Conclusion
In summary, the double free vulnerability in the Linux kernel's net subsystem poses a significant risk to system stability and security. It is crucial for users to update the 'linux' package to the patched version 6.7.12-1 to protect their systems from potential exploitation. Regular monitoring and timely updates are essential for maintaining system integrity.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a double free error in the Linux kernel's net subsystem, which can lead to memory corruption.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Potential consequences include system crashes, memory corruption, and exploitation by malicious actors, leading to unauthorized access.
Yes, the patched version of the 'linux' package is 6.7.12-1. Users should update to this version to mitigate the vulnerability.
If you cannot update immediately, ensure that your system is monitored for unusual activity and consider restricting access to sensitive areas until the patch can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
