Critical Vulnerability in Linux Kernel: Double Allocation Issue in SWIOTLB Handling
Summary
DEBIAN-CVE-2024-35814: In the Linux kernel, the following vulnerability has been resolved: swiotlb: Fix double-allocation of slots due to broken alignment handling Commit bbb73a103fbb ("swiotlb: fix a braino in the alignment check fix"), which... Affects linux versions < 6.7.12-1. Fixed in 6.7.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It manages system resources, including memory, processes, and device drivers. The kernel is crucial for system stability and performance. This specific vulnerability affects the SWIOTLB (Software I/O Translation Lookaside Buffer) functionality, which is responsible for managing DMA (Direct Memory Access) operations in environments with limited memory. The vulnerability arises from improper alignment handling, leading to potential system instability and data corruption.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the SWIOTLB module, where a fix for alignment checks inadvertently introduced a regression affecting virtio devices in virtual machines. This issue can cause double allocation of memory slots, leading to buffer corruption and system hangs. The root cause is a failure to ensure proper alignment during memory allocation, which can result in unaligned page allocations. This vulnerability can severely impact system performance and reliability, particularly in virtualized environments.
How To Fix
Minimum fixed version
6.7.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using virtio devices that rely on SWIOTLB for DMA operations until the package is updated. This may involve configuring the system to use alternative device drivers or adjusting the virtual machine settings to bypass the affected functionality.
Conclusion
The identified vulnerability in the Linux kernel's SWIOTLB handling poses significant risks to system stability and performance, particularly in virtualized environments. Users are strongly advised to update their systems to the patched version to mitigate these risks. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a double allocation issue in the SWIOTLB handling of the Linux kernel, which can lead to buffer corruption and system hangs.
The vulnerability affects Debian versions 13 and 14 of the Linux kernel prior to version 6.7.12-1.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
If exploited, this vulnerability can lead to system instability, data corruption, and performance degradation, particularly in virtualized environments.
Yes, the permanent fix is to update the Linux package to version 6.7.12-1 or later, which addresses the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
