Memory Corruption Vulnerability in Linux Kernel (Debian:13 and Debian:14)
Summary
DEBIAN-CVE-2024-35911: In the Linux kernel, the following vulnerability has been resolved: ice: fix memory corruption bug with suspend and rebuild The ice driver would previously panic after suspend. Affects linux versions < 6.8.9-1. Fixed in 6.8.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It is widely used across various platforms, including servers, desktops, and embedded systems. The kernel's stability and security are paramount, as vulnerabilities can lead to system crashes, data loss, or unauthorized access. This specific vulnerability affects the ice driver within the Linux kernel, which is responsible for managing network interfaces.
Vulnerability Detail
In the Linux kernel, a memory corruption vulnerability has been identified in the ice driver. This issue arises during the suspend and rebuild processes, where the driver improperly manages the num_q_vectors variable. The driver only calls the ice_vsi_free_q_vectors() function during suspension, leading to a scenario where a zero-length buffer is allocated. When num_q_vectors is updated and used to index into this buffer, it results in memory corruption and potential system panic. This vulnerability was introduced after commit b3e7b3a6ee92, which altered how num_q_vectors is handled, and it can lead to severe system instability.
How To Fix
Minimum fixed version
6.8.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate the risk.
Conclusion
The memory corruption vulnerability in the ice driver of the Linux kernel poses a significant risk to system stability during suspend and resume operations. Users are advised to update to the patched version 6.8.9-1 to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to memory corruption, causing system crashes and instability during suspend and resume operations.
You can use Vulert, which monitors open-source vulnerabilities in your software. By using the manifest file like package-lock.json, Vulert can alert you in real-time about vulnerabilities.
The vulnerability affects the Linux packages in Debian:13 and Debian:14 prior to version 6.8.9-1.
There are no specific workarounds available at this time. The best course of action is to apply the patch as soon as possible.
Detailed information can be found in the Debian CVE database or by visiting Vulert's playground at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
