Critical Soft Lockup Vulnerability in Linux Kernel Packages on Debian 13 and 14
Summary
DEBIAN-CVE-2024-36936: In the Linux kernel, the following vulnerability has been resolved: efi/unaccepted: touch soft lockup during memory accept Commit 50e782a86c98 ("efi/unaccepted: Fix soft lockups caused by parallel memory acceptance") has... Affects linux versions < 6.8.11-1. Fixed in 6.8.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware and system resources. It provides essential services for all other software running on the system, including process management, memory management, and device control. The kernel is a critical piece of software that must be secure and stable, as vulnerabilities can lead to system crashes, data loss, or unauthorized access. This specific vulnerability affects the memory acceptance process, which is crucial for managing system resources efficiently.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the memory acceptance process, specifically in the efi/unaccepted module. The issue arises when the spinlock is released, allowing other CPUs to perform memory acceptance in parallel. However, if the memory of the TD guest is large, it can lead to intermittent soft lockups, where the watchdog timer detects that the CPU has not been fed for a while. This can cause significant performance issues and system instability, particularly in environments with high memory demands.
How To Fix
Minimum fixed version
6.8.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can invoke the touch_softlockup_watchdog() function at the end of the accept_memory() process to prevent the soft lockup detection during this stage. However, this is not a permanent solution and should only be used until the system can be updated.
Conclusion
The identified soft lockup vulnerability in the Linux kernel affects Debian 13 and 14, posing risks to system stability and performance. Users are strongly advised to update their kernel packages to the patched version 6.8.11-1 to mitigate these risks. Temporary workarounds can be employed, but they do not replace the need for an update.
See every vulnerability recorded for linux →
FAQ
A soft lockup occurs when a CPU is unable to process interrupts for a certain period, leading to performance degradation and potential system instability.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By uploading your manifest file like package-lock.json, you can check if your application is affected by this vulnerability.
The vulnerability can lead to system crashes, performance issues, and instability, particularly in systems with high memory usage.
While the primary risk is system instability, there is a potential for data loss if the system crashes unexpectedly due to the vulnerability.
Detailed information can be found in the Debian CVE database and through security advisories related to the Linux kernel.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
