Critical Vulnerability in Linux Kernel: Freepointer Corruption in Memory Management
Summary
DEBIAN-CVE-2024-36892: In the Linux kernel, the following vulnerability has been resolved: mm/slub: avoid zeroing outside-object freepointer for single free Commit 284f17ac13fe ("mm/slub: handle bulk and single object freeing separately") spli... Affects linux versions < 6.8.11-1. Fixed in 6.8.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, managing hardware resources and providing essential services for software applications. It is known for its robustness and flexibility, supporting a wide range of devices and architectures. However, vulnerabilities can arise, affecting system stability and security. This specific vulnerability relates to memory management within the kernel, particularly in the SLUB memory allocator, which is responsible for efficient memory allocation and deallocation.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the mm/slub memory management subsystem. The issue arises from improper handling of free pointers during single object freeing operations. When the 'init_on_free' option is enabled, the slab_free_hook function zeroes the object, but if certain debug options are set, this can lead to a 'Freepointer corrupt' detection during consistency checks. This vulnerability can potentially allow an attacker to exploit memory corruption, leading to system instability or unauthorized access.
How To Fix
Minimum fixed version
6.8.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the 'init_on_free' option in the kernel configuration if it is not essential for their use case. This can be done by modifying the kernel boot parameters to remove 'init_on_free=1'. However, this is not a permanent solution and updating the kernel is recommended.
Conclusion
The identified vulnerability in the Linux kernel's memory management subsystem poses significant risks to system stability and security. Users are strongly advised to update their kernel to the latest patched version to mitigate these risks. Temporary workarounds may provide short-term relief, but a permanent fix through updates is essential for long-term security.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to memory corruption, which may result in system crashes or unauthorized access to sensitive data.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Yes, if exploited, this vulnerability could lead to data corruption or loss, especially if the system crashes unexpectedly.
If an immediate update is not possible, consider disabling the 'init_on_free' option as a temporary workaround until you can apply the patch.
Detailed information can be found in the official Debian CVE database or through security advisories related to the Linux kernel.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
