Critical Vulnerability in Linux Kernel: PE/COFF .compat Section Mapping Issue
Summary
DEBIAN-CVE-2024-26678: In the Linux kernel, the following vulnerability has been resolved: x86/efistub: Use 1:1 file:memory mapping for PE/COFF .compat section The .compat section is a dummy PE section that contains the address of the 32-bit e... Affects linux versions < 6.7.7-1. Fixed in 6.7.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interactions. It is widely used in various distributions, including Debian. The kernel's functionality includes managing system resources, enabling hardware communication, and providing a platform for applications. This specific vulnerability affects the kernel's handling of PE/COFF file formats, particularly in systems booted from 32-bit firmware, which could lead to compatibility issues with certain EFI loaders.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the x86/efistub component related to the mapping of the PE/COFF .compat section. This section, which is only 8 bytes in size, is incorrectly placed at the end of the memory view of the image, violating the PE/COFF specification. This misplacement can cause some PE loaders to reject the kernel image, potentially leading to boot failures. The issue arises when the kernel is booted from 32-bit firmware with CONFIG_EFI_MIXED enabled, which is rarely needed today. The vulnerability could affect system stability and compatibility with certain EFI implementations.
How To Fix
Minimum fixed version
6.7.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the CONFIG_EFI_MIXED option in your kernel configuration if it is not needed for your system. This can be done by modifying the kernel configuration file and recompiling the kernel, though this is generally not recommended unless you are familiar with kernel development.
Conclusion
The vulnerability in the Linux kernel regarding the PE/COFF .compat section poses significant risks for systems booted from 32-bit firmware. It is crucial for users to update their systems to the patched version to ensure compatibility and stability. Temporary workarounds exist, but applying the patch is the recommended course of action.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to boot failures on systems using certain PE loaders, affecting system stability and compatibility.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The patch reorganizes the sections in the kernel image to comply with the PE/COFF specification, preventing compatibility issues with PE loaders.
Disabling CONFIG_EFI_MIXED is generally safe if your system does not require it for booting, but it is advisable to assess your specific use case.
More details can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-26678.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
