Critical Vulnerability in Linux Kernel: Removal of Bogus SGL Free on Zero-Length Error Path
Summary
DEBIAN-CVE-2024-26824: In the Linux kernel, the following vulnerability has been resolved: crypto: algif_hash - Remove bogus SGL free on zero-length error path When a zero-length message is hashed by algif_hash, and an error is triggered, it t... Affects linux versions < 6.7.7-1. Fixed in 6.7.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and hardware interactions. It provides essential services for all other parts of the operating system, including process management, memory management, and device control. The kernel is highly modular and supports a wide range of hardware architectures. However, like any complex software, it is susceptible to vulnerabilities that can affect system stability and security.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the crypto subsystem, specifically within the algif_hash implementation. When a zero-length message is hashed, an error can occur that leads to an attempt to free a scatter-gather (SG) list that was never allocated. This flaw could potentially lead to undefined behavior or system crashes, compromising the integrity and reliability of the kernel. The vulnerability is classified as DEBIAN-CVE-2024-26824 and affects both Debian 13 and 14 versions of the Linux package.
How To Fix
Minimum fixed version
6.7.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
The vulnerability identified as DEBIAN-CVE-2024-26824 in the Linux kernel poses significant risks to system stability and security. Users are strongly advised to update their kernel to the fixed version 6.7.7-1 to mitigate potential threats. Regular monitoring and timely updates are essential for maintaining a secure system.
See every vulnerability recorded for linux →
FAQ
DEBIAN-CVE-2024-26824 is a vulnerability in the Linux kernel that affects the handling of zero-length messages in the crypto subsystem.
This vulnerability could lead to undefined behavior or system crashes, potentially compromising system stability and security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Yes, a patch is available in version 6.7.7-1 of the Linux kernel. Users should update to this version to mitigate the vulnerability.
While there are no specific workarounds, it is crucial to prioritize updating your kernel to the patched version as soon as possible to ensure system security.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
