Out-of-Bounds Access Vulnerability in Linux Kernel: linux Package Affected
Summary
DEBIAN-CVE-2024-27029: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix mmhub client id out-of-bounds access Properly handle cid 0x140. Affects linux versions < 6.7.12-1. Fixed in 6.7.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux package is a core component of the Debian operating system, providing the essential kernel that manages system resources and hardware interactions. It is responsible for facilitating communication between software applications and hardware components. This package is critical for system stability and performance, and vulnerabilities within it can lead to severe security risks, including unauthorized access and system crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the drm/amdgpu module, which allows for an out-of-bounds access due to improper handling of the client ID (cid) 0x140. This flaw can potentially lead to memory corruption, system instability, or unauthorized access to sensitive data. The vulnerability has been cataloged as DEBIAN-CVE-2024-27029 and affects both Debian 13 and 14 versions of the linux package. The issue arises from the failure to properly validate the cid, which could be exploited by an attacker to manipulate memory access.
How To Fix
Minimum fixed version
6.7.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The out-of-bounds access vulnerability in the Linux kernel's drm/amdgpu module poses significant risks to system security and stability. Users of the linux package in Debian 13 and 14 are advised to update to the patched version 6.7.12-1 to protect their systems. Regular monitoring for vulnerabilities using tools like Vulert can further enhance security.
See every vulnerability recorded for linux →
FAQ
The vulnerability is an out-of-bounds access issue in the drm/amdgpu module of the Linux kernel, which can lead to memory corruption and potential system instability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could result in unauthorized access to sensitive data, system crashes, or overall instability of the operating system.
Yes, a patch is available in version 6.7.12-1 of the linux package. Users are encouraged to update to this version to mitigate the risk.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json. It provides real-time alerts for vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
