Kernel Vulnerability in Linux Package: NULL Pointer Dereference in vsnprintf()
Summary
DEBIAN-CVE-2024-35878: In the Linux kernel, the following vulnerability has been resolved: of: module: prevent NULL pointer dereference in vsnprintf() In of_modalias(), we can get passed the str and len parameters which would cause a kernel oo... Affects linux versions < 6.8.9-1. Fixed in 6.8.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It is known for its stability, performance, and security features. However, like any software, it can be susceptible to vulnerabilities. This specific issue affects the Linux package versions in Debian 13 and 14, highlighting a flaw in the handling of parameters in the of_modalias() function, which can lead to system instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified that allows for a NULL pointer dereference in the vsnprintf() function. This occurs when the str and len parameters are incorrectly passed, leading to a kernel oops. The vulnerability arises from the failure to filter negative values of the len parameter, which can result in a buffer overflow since snprintf() expects a size_t parameter while the len is of type ssize_t. Discovered by the Linux Verification Center using the Svace static analysis tool, this flaw could lead to system crashes or unexpected behavior.
How To Fix
Minimum fixed version
6.8.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is advisable to apply the patch as soon as it becomes available to mitigate any potential risks.
Conclusion
The identified vulnerability in the Linux kernel poses a significant risk to system stability due to a NULL pointer dereference in the vsnprintf() function. It is crucial for users to update their Linux packages to the patched version 6.8.9-1 to mitigate this risk. Regular monitoring using tools like Vulert can help maintain awareness of vulnerabilities in open-source software.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a NULL pointer dereference in the vsnprintf() function within the Linux kernel, which can lead to system crashes.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
If exploited, this vulnerability could lead to kernel oops, resulting in system instability and crashes.
Yes, the patched version of the Linux package is 6.8.9-1 for both Debian 13 and 14.
You can update your Linux package by running 'sudo apt-get update' followed by 'sudo apt-get install linux=6.8.9-1' in your terminal.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
