Critical Memory Initialization Vulnerability in Linux Package: Debian 13 and 14
Summary
DEBIAN-CVE-2024-38592: In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Init ddp_comp with devm_kcalloc() In the case where conn_routes is true we allocate an extra slot in the ddp_comp array but mtk_drm_crtc_c... Affects linux versions < 6.8.12-1. Fixed in 6.8.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It serves as the foundation for running applications and services on Debian systems. The vulnerability in question arises from improper initialization of memory in the Direct Rendering Manager (DRM) subsystem, specifically within the Mediatek driver, which can lead to system crashes under certain conditions.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the DRM subsystem related to the Mediatek driver. The issue stems from the initialization of the 'ddp_comp' array, which is not properly handled when the 'conn_routes' flag is true. This oversight can lead to a crash during the execution of the 'mtk_drm_crtc_mode_valid()' function, particularly when memory is poisoned using 'slub_debug=FZPUA'. The failure to initialize this memory can result in unpredictable behavior, including system instability and crashes, especially in scenarios where memory is not zeroed out by default.
How To Fix
Minimum fixed version
6.8.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid the crash by not enabling the 'slub_debug=FZPUA' option during boot. However, this does not address the underlying issue and should only be considered a short-term solution until the package is updated.
Conclusion
The identified vulnerability in the Linux package poses a significant risk of system crashes due to improper memory initialization. Users are strongly advised to update to the latest patched version to mitigate this risk. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time, ensuring that systems remain secure.
See every vulnerability recorded for linux →
FAQ
The vulnerability is related to improper memory initialization in the Linux kernel's DRM subsystem, which can lead to system crashes.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If exploited, this vulnerability can lead to system instability and crashes, particularly when specific memory conditions are met.
Yes, updating to the patched version of the Linux package (6.8.12-1) resolves the vulnerability.
If you cannot update right away, avoid using the 'slub_debug=FZPUA' option as a temporary workaround to prevent crashes.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
