Kernel Panic Risk in Linux Package Due to PHY Access Issue
Summary
DEBIAN-CVE-2024-36887: In the Linux kernel, the following vulnerability has been resolved: e1000e: change usleep_range to udelay in PHY mdic access This is a partial revert of commit 6dbdd4de0362 ("e1000e: Workaround for sporadic MDI error on... Affects linux versions < 6.8.11-1. Fixed in 6.8.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware and system resources. It is responsible for facilitating communication between software and hardware. The kernel is modular, allowing for various drivers and functionalities to be included. However, it is susceptible to vulnerabilities that can lead to system instability or crashes. This specific vulnerability affects the e1000e driver, which is used for Intel Ethernet controllers, particularly in scenarios involving cable disconnection and reconnection on vPro systems.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified in the e1000e driver related to the use of usleep_range in PHY access routines. This function can lead to a kernel panic when called from an atomic context, particularly during cable disconnection and reconnection events. The issue arises from a partial revert of a previous commit that aimed to address sporadic MDI errors on Meteor Lake systems. The improper use of usleep_range in this context can cause the system to crash, posing significant risks to system stability and reliability.
How To Fix
Minimum fixed version
6.8.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability other than applying the patch. Users are advised to monitor their systems for any unusual behavior and apply the update as soon as it is available.
Conclusion
The vulnerability in the Linux kernel's e1000e driver poses a significant risk of kernel panic under specific conditions. It is crucial for users to update to the patched version 6.8.11-1 to ensure system stability. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software without requiring extensive setup.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves a kernel panic risk due to improper use of usleep_range in the e1000e driver, which can lead to system crashes during specific hardware events.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
Failure to address this vulnerability may result in unexpected kernel panics, leading to system instability and potential data loss.
Yes, the vulnerability is fixed in version 6.8.11-1 of the Linux package. Users should upgrade to this version or later.
Detailed information can be found in the Debian CVE database or by visiting Vulert, which provides insights into open-source vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
