Critical Buffer Overflow Vulnerability in Linux Package: CVE-2024-35901
Summary
DEBIAN-CVE-2024-35901: In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix Rx DMA datasize and skb_over_panic mana_get_rxbuf_cfg() aligns the RX buffer's DMA datasize to be multiple of 64. Affects linux versions < 6.8.9-1. Fixed in 6.8.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It serves as the foundation for various applications and services, ensuring efficient operation and communication between software and hardware. This vulnerability specifically affects the network subsystem, where improper handling of oversized packets can lead to severe system instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the mana network driver related to the handling of receive (Rx) buffers. The function mana_get_rxbuf_cfg() incorrectly aligns the DMA datasize of the RX buffer, allowing oversized packets (e.g., 1536 bytes) to be processed incorrectly. This misalignment can trigger a buffer overflow, leading to an skb_over_panic error, which may crash the kernel and cause system instability. The vulnerability is rooted in the unnecessary alignment requirement for the DMA datasize, which, when violated, results in the kernel panicking and potentially exposing the system to further risks.
How To Fix
Minimum fixed version
6.8.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the size of packets being processed by configuring the network settings to drop oversized packets. This can be done by adjusting the MTU (Maximum Transmission Unit) settings on the network interface. For example, to set the MTU to 1500, use the command: 'sudo ip link set dev <interface_name> mtu 1500', replacing <interface_name> with the actual name of the network interface.
Conclusion
The CVE-2024-35901 vulnerability in the Linux kernel poses a significant risk due to improper handling of oversized packets, leading to potential system crashes. Users are strongly advised to update their Linux packages to the patched version 6.8.9-1 to mitigate this risk. For those unable to update immediately, adjusting network settings can serve as a temporary workaround.
See every vulnerability recorded for linux →
FAQ
CVE-2024-35901 is a vulnerability in the Linux kernel that affects the mana network driver, leading to potential buffer overflow and system crashes.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Exploitation of this vulnerability can lead to kernel panics, system instability, and potential data loss, making it critical to apply the patch.
Yes, the vulnerability has been patched in version 6.8.9-1 of the Linux package for both Debian 13 and Debian 14.
If immediate updates are not possible, consider implementing a workaround by adjusting the MTU settings to drop oversized packets temporarily.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
