Double Free Vulnerability in Linux Kernel: Impacting Debian Packages
Summary
DEBIAN-CVE-2024-26930: In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix double free of the ha->vp_map pointer Coverity scan reported potential risk of double free of the pointer ha->vp_map. Affects linux versions < 6.7.12-1. Fixed in 6.7.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It is widely used across various distributions, including Debian. This vulnerability affects the Linux kernel versions in Debian 13 and 14, specifically related to the SCSI subsystem, which handles communication between the operating system and storage devices.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the SCSI driver for QLogic Fibre Channel adapters (qla2xxx). The issue arises from a double free of the pointer 'ha->vp_map', which can lead to memory corruption and potential exploitation. The pointer is freed twice: once in the function 'qla2x00_mem_alloc()' and again in 'qla2x00_mem_free(ha)'. This flaw was reported by Coverity scan, highlighting the risk of double freeing memory, which can compromise system stability and security.
How To Fix
Minimum fixed version
6.7.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected SCSI driver until the system is updated. However, this may not be feasible for all users depending on their hardware configuration.
Conclusion
The double free vulnerability in the Linux kernel poses significant risks to systems running Debian 13 and 14. It is crucial for users to update their kernel packages to the patched version 6.7.12-1 to safeguard against potential exploitation. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
A double free vulnerability occurs when a program attempts to free the same memory location more than once, which can lead to memory corruption and potential exploitation by attackers.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your manifest file without needing to sign up.
Failing to address this vulnerability may expose your system to memory corruption, crashes, and potential exploitation by malicious actors, leading to unauthorized access or data loss.
Yes, the patched version 6.7.12-1 for Debian 13 and 14 resolves this vulnerability. It is recommended to update to this version to ensure system security.
While you can continue using your system, it is advisable to limit the use of the affected SCSI driver until the patch is applied to mitigate potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
