Inconsistent Permission Handling in Linux Kernel's Tracefs - CVE-2024-36963
Summary
DEBIAN-CVE-2024-36963: In the Linux kernel, the following vulnerability has been resolved: tracefs: Reset permissions on remount if permissions are options There's an inconsistency with the way permissions are handled in tracefs. Affects linux versions < 6.8.11-1. Fixed in 6.8.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It is responsible for managing system resources and ensuring that applications can run efficiently. The tracefs filesystem is a special filesystem in the Linux kernel that allows for tracing and debugging of kernel events. This vulnerability arises from the way permissions are managed within tracefs, leading to potential security risks if not addressed.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the tracefs filesystem regarding permission handling during remount operations. When permissions are set by a user, they are saved, but if a remount occurs with new permissions specified, only files that were not altered by the user are updated. This inconsistency can lead to security issues, as administrators may mistakenly believe that remounting with new permissions will apply to all files, potentially leaving some files with outdated permissions.
How To Fix
Minimum fixed version
6.8.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, administrators should be cautious when remounting tracefs and verify permissions manually to ensure that all files have the correct settings.
Conclusion
The vulnerability CVE-2024-36963 in the Linux kernel's tracefs filesystem poses a significant risk due to inconsistent permission handling during remount operations. It is crucial for users to update their systems to the patched version and remain vigilant about permission settings to maintain security.
See every vulnerability recorded for linux →
FAQ
CVE-2024-36963 is a vulnerability in the Linux kernel's tracefs filesystem that affects how permissions are handled during remount operations.
If not addressed, this vulnerability can lead to incorrect permissions on files within tracefs, potentially exposing sensitive information or allowing unauthorized access.
You should update your Linux package to version 6.8.11-1 or later to ensure that the vulnerability is patched.
There are no specific workarounds available, but it is advisable to manually check and verify permissions after remounting tracefs.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using a manifest file like package-lock.json. You can check your application for vulnerabilities without signup at the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
