Critical Vulnerability in Linux Package: Out-of-Bound Access Risk
Summary
DEBIAN-CVE-2024-26968: In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gcc-ipq9574: fix terminating of frequency table arrays The frequency table arrays are supposed to be terminated with an empty element. Affects linux versions < 6.7.12-1. Fixed in 6.7.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionality for managing hardware and system resources. It is widely used across various distributions and versions, including Debian 13 and 14. This package is known for its stability and performance, but it is also susceptible to vulnerabilities that can compromise system security.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2024-26968 arises from an issue in the Linux kernel related to the frequency table arrays in the qcom GCC IPQ9574 driver. These arrays are expected to be terminated with an empty element, but in this case, they are not. This oversight can lead to out-of-bound access when functions like qcom_find_freq() or qcom_find_freq_floor() traverse the table, potentially causing system crashes or unpredictable behavior.
How To Fix
Minimum fixed version
6.7.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The vulnerability DEBIAN-CVE-2024-26968 poses a significant risk due to the potential for out-of-bound access in the Linux kernel. Users are strongly advised to update their systems to the latest patched version to ensure security and stability. Regular monitoring using tools like Vulert can help maintain awareness of vulnerabilities in open-source software.
See every vulnerability recorded for linux →
FAQ
It is a vulnerability in the Linux kernel that can lead to out-of-bound access due to improperly terminated frequency table arrays.
If exploited, this vulnerability could cause system crashes or unpredictable behavior, potentially compromising system stability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
While there are no specific workarounds, it is crucial to prioritize updating to the patched version as soon as possible to mitigate risks.
Detailed information can be found in the official Debian CVE database or by visiting the provided source link in the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
