Firewire IRQ Leak Vulnerability in Linux Package
Summary
DEBIAN-CVE-2024-35816: In the Linux kernel, the following vulnerability has been resolved: firewire: ohci: prevent leak of left-over IRQ on unbind Commit 5a95f1ded28691e6 ("firewire: ohci: use devres for requested IRQ") also removed the call t... Affects linux versions < 6.7.12-1. Fixed in 6.7.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, responsible for managing hardware interactions and system resources. It provides essential functionalities, including process management, memory management, and device control. The package is critical for system stability and performance, making it vital for users to maintain its security and integrity.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the Firewire OHCI driver. The issue arises from the removal of the call to free_irq() in the pci_remove() function, which leads to a leftover IRQ from devm_request_irq() during the unbinding of the driver from the device. This oversight can result in a memory leak, as the system fails to properly release the IRQ resources, potentially leading to system instability and resource exhaustion. The vulnerability is documented under DEBIAN-CVE-2024-35816 and affects both Debian 13 and 14 versions of the Linux package.
How To Fix
Minimum fixed version
6.7.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users are advised to monitor their systems for any unusual behavior and ensure that they apply the necessary updates as soon as they are available.
Conclusion
The Firewire IRQ leak vulnerability in the Linux package poses a significant risk to system stability and performance. Users are strongly encouraged to update to the patched version to mitigate this risk. Regular monitoring and prompt updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves a memory leak due to improper handling of IRQ resources in the Firewire OHCI driver.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner.
If exploited, this vulnerability could lead to system instability and resource exhaustion, affecting overall system performance.
Yes, a patch is available in version 6.7.12-1 of the Linux package. Users should update to this version or later.
While there are no specific workarounds, it is advisable to monitor your system for any unusual behavior and plan to apply the update as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
