Critical Vulnerability in Linux Package: Unconditional Registration Removal in DPLL Driver
Summary
DEBIAN-CVE-2024-27027: In the Linux kernel, the following vulnerability has been resolved: dpll: fix dpll_xa_ref_*_del() for multiple registrations Currently, if there are multiple registrations of the same pin on the same dpll device, followi... Affects linux versions < 6.7.12-1. Fixed in 6.7.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionality for managing system resources and hardware interactions. It is widely used across various distributions and is known for its robustness and performance. However, like any complex software, it is susceptible to vulnerabilities that can impact system stability and security.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the DPLL (Digital Phase-Locked Loop) driver. The issue arises when multiple registrations of the same pin on a DPLL device occur, leading to warnings during operation. The root cause is that the registration is only removed from the list when the reference count drops to zero, which is incorrect. The registration should be removed unconditionally to prevent potential system instability and resource leaks.
How To Fix
Minimum fixed version
6.7.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The identified vulnerability in the Linux package's DPLL driver poses a risk of system instability due to improper registration handling. Users are encouraged to update to the latest patched version to ensure system security and stability. Utilizing tools like Vulert can help in monitoring for such vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system instability and warnings during operation, particularly when multiple registrations of the same pin occur.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Yes, a patch is available in version 6.7.12-1 of the Linux package. Users should update to this version or later.
While there are no specific workarounds, it is advisable to monitor the situation and apply the patch as soon as possible to mitigate risks.
Detailed information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-27027.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
