Critical Vulnerability in Linux Package: 64-bit Statistics Counters Update Issue
Summary
DEBIAN-CVE-2024-26690: In the Linux kernel, the following vulnerability has been resolved: net: stmmac: protect updates of 64-bit statistics counters As explained by a comment in , write side of struct u64_stats_sync must ensure mutual exclusi... Affects linux versions < 6.7.7-1. Fixed in 6.7.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It is widely used across various distributions and is known for its stability and performance. However, it is susceptible to vulnerabilities that can affect system reliability and security, such as the recent issue with the update of 64-bit statistics counters, which can lead to system lockups under certain conditions.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the handling of 64-bit statistics counters in the net: stmmac module. This issue arises from improper mutual exclusion during updates to the struct u64_stats_sync, particularly on 32-bit platforms. If the write side of this structure is not properly synchronized, it can lead to lost updates, causing readers to be blocked indefinitely. This vulnerability can manifest in real-world scenarios where concurrent operations on different CPUs interfere with each other, leading to system instability and potential denial of service.
How To Fix
Minimum fixed version
6.7.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users are advised to monitor their systems for unusual behavior and apply the patch as soon as it is available.
Conclusion
The vulnerability in the Linux package regarding the update of 64-bit statistics counters poses a significant risk to system stability. Users are encouraged to update to the patched version 6.7.7-1 to ensure their systems are secure. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software without requiring extensive setup.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper synchronization of updates to 64-bit statistics counters in the Linux kernel, leading to potential system lockups.
If you are using an affected version of the Linux package prior to 6.7.7-1, your system may be vulnerable. You can check your version using 'uname -r' in the terminal.
The primary risk is system instability, which can result in denial of service due to blocked readers waiting for updates that never occur.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check your application for this vulnerability using the Vulert playground.
While there are no specific workarounds, it is advisable to monitor system performance closely and plan for an update as soon as possible to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
