Critical Vulnerability in Linux Kernel: iommu/vt-d Device Tracking Issue
Summary
DEBIAN-CVE-2024-35957: In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix WARN_ON in iommu probe path Commit 1a75cc710b95 ("iommu/vt-d: Use rbtree to track iommu probed devices") adds all devices probed by the... Affects linux versions < 6.8.9-1. Fixed in 6.8.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system functionality. It supports a wide range of devices and architectures, making it a fundamental part of both server and desktop environments. This vulnerability affects the Linux kernel versions in Debian 13 and 14, specifically related to the iommu/vt-d subsystem, which is responsible for managing device memory and ensuring efficient communication between devices and the CPU.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the iommu/vt-d subsystem, where the assumption that each device has a unique source ID is incorrect. This flaw arises from a commit that introduced a red-black tree (rbtree) to track devices probed by the iommu driver. The incorrect assumption can lead to unnecessary WARN_ON messages during the iommu probe path, potentially causing the probe to fail on certain platforms. This issue can disrupt the normal operation of devices that rely on the iommu subsystem, impacting system stability and performance.
How To Fix
Minimum fixed version
6.8.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users are advised to monitor their systems for any unusual behavior and apply the patch as soon as it is available.
Conclusion
The identified vulnerability in the Linux kernel's iommu/vt-d subsystem poses a risk to system stability and device functionality. Users are encouraged to update their kernel to the patched version 6.8.9-1 to mitigate this issue. Regular monitoring and prompt updates are crucial for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability is related to incorrect assumptions about device source IDs in the iommu/vt-d subsystem, which can lead to system instability.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
The vulnerability can cause unnecessary warnings during device probing, leading to failures in the iommu subsystem, which may disrupt device functionality.
Yes, a patch is available in the form of the Linux kernel version 6.8.9-1 for both Debian 13 and 14.
While there are no specific workarounds, it is essential to monitor your system for any unusual behavior and plan to apply the patch as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
