Deadlock Vulnerability in Linux Kernel: Impacting Debian Packages
Summary
DEBIAN-CVE-2024-38557: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Reload only IB representors upon lag disable/enable On lag disable, the bond IB device along with all of its representors are destroyed, and t... Affects linux versions < 6.8.12-1. Fixed in 6.8.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is a core component of the Debian operating system, responsible for managing hardware resources and providing essential services to applications. It is known for its stability, performance, and security features. However, vulnerabilities can arise, affecting its functionality and the overall security of systems running Debian. This specific vulnerability affects the Linux package in Debian 13 and 14, highlighting a flaw in the handling of link aggregation (LAG) devices.
Vulnerability Detail
In the Linux kernel, a deadlock vulnerability has been identified in the net/mlx5 component, specifically during the enable/disable process of link aggregation (LAG). When LAG is disabled, the bond IB device and its representors are destroyed, followed by the reloading of slave representors. If the loading of slave IB representors fails, the error handling process incorrectly unloads all representors, including Ethernet representors, leading to a deadlock situation. This occurs because the LAG lock is held during the disable process, but is required again when detaching Ethernet representors, resulting in a circular wait condition.
How To Fix
Minimum fixed version
6.8.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid enabling or disabling LAG until the patch is applied. This will prevent the deadlock situation from occurring while waiting for the official fix.
Conclusion
The deadlock vulnerability in the Linux kernel affects Debian packages and poses a risk to system stability during link aggregation operations. Users are encouraged to update their systems to the latest patched version to mitigate this risk. Temporary workarounds are available, but applying the patch is the best solution.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a deadlock issue in the Linux kernel's handling of link aggregation devices, which can lead to system instability.
Debian 13 and 14 are affected by this vulnerability in the Linux package.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any installation.
Yes, a patch is available in version 6.8.12-1 of the Linux package. It is recommended to update to this version or later.
If you cannot apply the patch immediately, it is advisable to avoid enabling or disabling link aggregation until the patch is applied to prevent potential deadlock issues.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
