Kernel Panic Vulnerability in Linux Package: Critical Memory Access Issue
Summary
DEBIAN-CVE-2024-26674: In the Linux kernel, the following vulnerability has been resolved: x86/lib: Revert to _ASM_EXTABLE_UA() for {get,put}_user() fixups During memory error injection test on kernels >= v6.4, the kernel panics like below. Affects linux versions < 6.7.7-1. Fixed in 6.7.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It is responsible for facilitating communication between software and hardware, ensuring efficient operation of applications. This vulnerability affects versions of the Linux kernel starting from 6.4, leading to potential kernel panics during memory error injection tests.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the handling of user memory access during error conditions. Specifically, the issue arises when the kernel attempts to access user memory with incorrect fixup types, leading to kernel panics. The vulnerability was introduced by changes made in commits that altered the way memory access errors are handled, resulting in a failure to recover from certain machine check exceptions (MCEs). This can lead to system instability and crashes, particularly in environments where memory errors are prevalent.
How To Fix
Minimum fixed version
6.7.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate the risks associated with this issue.
Conclusion
The identified vulnerability in the Linux package poses significant risks to system stability due to improper handling of memory access errors. It is crucial for users to update to the patched version 6.7.7-1 or later to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper handling of user memory access in the Linux kernel, leading to potential kernel panics.
The vulnerability affects Linux kernel versions starting from 6.4 up to 6.7.6.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failure to address this vulnerability may result in system instability, crashes, and potential data loss during memory error conditions.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
