Critical Debugfs Handling Vulnerability in Linux Package
Summary
DEBIAN-CVE-2024-35793: In the Linux kernel, the following vulnerability has been resolved: debugfs: fix wait/cancellation handling during remove Ben Greear further reports deadlocks during concurrent debugfs remove while files are being access... Affects linux versions < 6.7.12-1. Fixed in 6.7.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing the essential kernel that manages system resources and hardware interactions. It is responsible for enabling the execution of applications and ensuring system stability. This vulnerability specifically affects the debugfs functionality, which is used for debugging and monitoring kernel operations. The issue arises from improper handling of wait and cancellation processes during the removal of debugfs entries, potentially leading to deadlocks.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the debugfs subsystem, where the handling of wait and cancellation during the removal of debugfs entries is flawed. This issue can lead to deadlocks when multiple concurrent operations attempt to access debugfs files while they are being removed. The root cause lies in incorrect logic regarding reference counting, which prevents the system from properly triggering cancellation processes. If the reference count reaches zero, the operation can complete without waiting, but if it does not, all cancellations must be triggered. The existing code fails to enter the loop that would initiate these cancellations, resulting in potential system hangs.
How To Fix
Minimum fixed version
6.7.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate any potential risks associated with this issue.
Conclusion
The identified vulnerability in the Linux package's debugfs handling poses a significant risk of deadlocks during concurrent operations. It is essential for users to update to the patched version 6.7.12-1 to mitigate this risk. Regular monitoring and prompt application of updates are crucial for maintaining system stability and security.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to deadlocks in the system when concurrent operations are performed on debugfs files, potentially causing the system to hang.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
Yes, a patch is available in version 6.7.12-1 of the Linux package. It is recommended to update to this version to resolve the issue.
While there are no specific workarounds, it is crucial to monitor the situation and apply the patch as soon as possible to avoid potential deadlocks.
The vulnerability was reported by Ben Greear, who highlighted the issues with deadlocks during concurrent debugfs operations.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
