Critical TLB Flushing Issue in Linux Kernel: Impacting Debian Linux Packages
Summary
DEBIAN-CVE-2024-35980: In the Linux kernel, the following vulnerability has been resolved: arm64: tlb: Fix TLBI RANGE operand KVM/arm64 relies on TLBI RANGE feature to flush TLBs when the dirty pages are collected by VMM and the page table ent... Affects linux versions < 6.8.9-1. Fixed in 6.8.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware resources and providing essential services to applications. It is widely used in various environments, from servers to personal computers. The kernel's stability and security are paramount, as vulnerabilities can lead to severe consequences, including system crashes and data loss. This specific vulnerability affects the arm64 architecture, particularly during live migration of virtual machines, where proper flushing of Translation Lookaside Buffers (TLBs) is crucial.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the TLBI RANGE operand used in KVM/arm64. This issue arises from a failure to correctly sort the operand passed to the TLBI RANGE instruction, which is essential for flushing TLBs when dirty pages are collected during live migration. The incorrect operand can lead to crashes on the destination VM, as TLBs may not be fully flushed, resulting in missed dirty pages. This vulnerability was introduced due to a commit that defined the kvm_tlb_flush_vmid_range() function, which did not account for certain operand combinations, leading to potential system instability.
How To Fix
Minimum fixed version
6.8.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate the risk.
Conclusion
The identified vulnerability in the Linux kernel poses significant risks during live migration of virtual machines, potentially leading to system crashes and data loss. It is essential for users to update their Linux packages to the patched version 6.8.9-1 to ensure system stability and security. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to crashes in virtual machines during live migration, potentially causing data loss and system instability.
You can use Vulert, which monitors open-source vulnerabilities in your software. By utilizing the Vulert playground, you can check if your application is affected without any signup.
The vulnerability affects Debian Linux packages in versions prior to 6.8.9-1.
Yes, a patch is available in version 6.8.9-1 of the Linux package. It is recommended to update to this version.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risks associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
