Critical Vulnerability in Linux Package: net/mlx5 Driver Lock Issue
Summary
DEBIAN-CVE-2024-35961: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Register devlink first under devlink lock In case device is having a non fatal FW error during probe, the driver will report the error to user... Affects linux versions < 6.8.9-1. Fixed in 6.8.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of many operating systems, providing essential functionalities for managing hardware and system resources. It is widely used across various distributions, including Debian. The package is known for its robustness and versatility, but like any complex software, it can be susceptible to vulnerabilities that may affect system stability and security. This specific vulnerability relates to the net/mlx5 driver, which is responsible for managing network devices and their interactions with the Linux kernel.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the net/mlx5 driver related to the order of operations during device initialization. Specifically, when a device encounters a non-fatal firmware error during probe, the driver reports this error via devlink, leading to a WARN_ON condition. This occurs because the mlx5 driver calls devlink_register() last, which can trigger warnings and potentially disrupt normal operations. The issue is rooted in the improper locking mechanism used during the registration process, which can lead to instability in network operations.
How To Fix
Minimum fixed version
6.8.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid triggering the WARN_ON condition by ensuring that the mlx5 driver does not register devlink under the devlink lock until the device is fully initialized. However, this is not a permanent fix and should only be used until the package can be updated.
Conclusion
In summary, the identified vulnerability in the Linux package's net/mlx5 driver poses a significant risk to system stability and security. Users are strongly encouraged to update to the patched version to mitigate these risks. For those unable to update immediately, a temporary workaround is available, but it is not a long-term solution.
See every vulnerability recorded for linux →
FAQ
The vulnerability is related to the order of operations in the mlx5 driver during device initialization, which can lead to warnings and potential instability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failure to address this vulnerability may result in system instability, network disruptions, and potential security risks.
Yes, a patch is available in the form of an updated Linux package version 6.8.9-1.
If an immediate update is not possible, consider implementing the suggested workaround to mitigate the risk until the package can be updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
