Critical Vulnerability in Linux Kernel: DPLL Pin Registration Issue
Summary
DEBIAN-CVE-2024-36002: In the Linux kernel, the following vulnerability has been resolved: dpll: fix dpll_pin_on_pin_register() for multiple parent pins In scenario where pin is registered with multiple parent pins via dpll_pin_on_pin_register... Affects linux versions < 6.8.9-1. Fixed in 6.8.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and flexibility, supporting a wide range of devices and architectures. However, it is not immune to vulnerabilities, such as the one identified in the DPLL (Digital Phase-Locked Loop) subsystem, which can lead to system crashes under specific conditions.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the DPLL subsystem related to the function dpll_pin_on_pin_register(). When a pin is registered with multiple parent pins, a subsequent call to dpll_pin_on_pin_unregister() can lead to a call trace and potential system crash. This occurs because the function attempts to access already released registration resources, resulting in a warning and call trace when the ice driver is removed from a system with an installed E810T NIC. The issue arises from the improper handling of registration resources when pins are registered multiple times.
How To Fix
Minimum fixed version
6.8.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workaround has been provided for this vulnerability. Users are advised to apply the patch as soon as it becomes available to mitigate the risk.
Conclusion
The identified vulnerability in the Linux kernel's DPLL subsystem poses a significant risk, particularly for systems utilizing the ice driver with E810T NICs. Users are strongly encouraged to update to the patched version to ensure system stability and security. Utilizing tools like Vulert can further enhance vulnerability management and awareness.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper handling of DPLL pin registrations, which can lead to system crashes when certain conditions are met.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to system crashes, causing downtime and potential data loss.
Yes, a patch is available in version 6.8.9-1 of the Linux package. Users should update to this version to mitigate the vulnerability.
Vulert is a tool that monitors and alerts users in real-time for open-source vulnerabilities in software, using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
