Critical Divide-by-Zero Vulnerability in Linux Kernel - linux Package
Summary
DEBIAN-CVE-2024-26945: In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - Fix nr_cpus < nr_iaa case If nr_cpus < nr_iaa, the calculated cpus_per_iaa will be 0, which causes a divide-by-0 in rebalance_wq_table(). Affects linux versions < 6.8.9-1. Fixed in 6.8.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux package is an essential component of the Debian operating system, providing the core functionality required for hardware interaction and system management. It serves as the foundation for running applications and managing system resources. The kernel is responsible for managing CPU, memory, and device drivers, making it a critical element for system stability and performance. This vulnerability affects the kernel's ability to handle certain configurations of CPU and IAA (Intelligent Adaptive Architecture), potentially leading to system crashes or instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified where the calculation of 'cpus_per_iaa' can result in a divide-by-zero error if the number of CPUs is less than the number of IAAs. This situation arises when 'nr_cpus' is less than 'nr_iaa', leading to a crash in the 'rebalance_wq_table()' function. The issue is exacerbated in scenarios where 'nr_iaa' is zero, as the kernel may still attempt to perform calculations that are not necessary. This vulnerability could lead to system instability and crashes, impacting the overall reliability of systems running affected versions of the kernel.
How To Fix
Minimum fixed version
6.8.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability other than applying the patch. It is advisable to monitor system configurations to avoid scenarios where 'nr_cpus' is less than 'nr_iaa'.
Conclusion
The identified vulnerability in the Linux kernel poses a significant risk to system stability and performance. It is essential for users to update their linux package to the patched version 6.8.9-1 to mitigate this risk. Regular monitoring and prompt updates are critical for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes and instability, particularly in configurations where the number of CPUs is less than the number of IAAs.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Yes, a patch has been released in version 6.8.9-1 of the linux package. Updating to this version will resolve the vulnerability.
While there are no specific workarounds, it is crucial to monitor your system for unusual behavior and plan for an update as soon as possible.
Detailed information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-26945.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
