Critical Descriptor Leak in Linux Kernel: linux Package Vulnerability
Summary
DEBIAN-CVE-2024-35926: In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - Fix async_disable descriptor leak The disable_async paths of iaa_compress/decompress() don't free idxd descriptors in the async_disable ca... Affects linux versions < 6.8.9-1. Fixed in 6.8.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux package is a core component of the Debian operating system, providing the Linux kernel that manages system resources and hardware interactions. It is essential for system stability and performance. This vulnerability affects versions of the linux package in Debian 13 and 14, specifically related to the crypto subsystem, which handles cryptographic operations.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the crypto subsystem, specifically in the async_disable paths of the iaa_compress and iaa_decompress functions. The issue arises when idxd descriptors are not freed in cases where the request's destination (req->dst) is set to null. This can lead to a descriptor leak, potentially exhausting system resources and impacting performance or stability. The vulnerability has been assigned the identifier DEBIAN-CVE-2024-35926.
How To Fix
Minimum fixed version
6.8.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available.
Conclusion
The vulnerability identified in the linux package of the Debian operating system poses a significant risk due to a descriptor leak in the crypto subsystem. Users are strongly advised to update to the patched version 6.8.9-1 to ensure system stability and security. Monitoring tools like Vulert can assist in identifying vulnerabilities in your applications.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves a descriptor leak in the Linux kernel's crypto subsystem, which can lead to resource exhaustion.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected without any signup.
If exploited, this vulnerability could lead to system instability, performance degradation, or even crashes due to resource exhaustion.
Yes, a patch is available in version 6.8.9-1 of the linux package. Users should update to this version or later.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risk associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
