Out of Bounds Memory Read Vulnerability in Linux Kernel - Debian Packages
Summary
DEBIAN-CVE-2024-38606: In the Linux kernel, the following vulnerability has been resolved: crypto: qat - validate slices count returned by FW The function adf_send_admin_tl_start() enables the telemetry (TL) feature on a QAT device by sending... Affects linux versions < 6.8.12-1. Fixed in 6.8.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware resources and providing essential services to applications. It supports a wide range of functionalities, including process management, memory management, and device control. The kernel is crucial for system stability and performance. However, vulnerabilities within the kernel can lead to severe security risks, including unauthorized access to memory and potential system crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the crypto: qat feature, specifically in the function adf_send_admin_tl_start(). This function enables telemetry on a QAT device by sending a message to the firmware, which then returns an array indicating the number of supported accelerators. If the firmware were to return an incorrect value, it could lead to an out of bounds memory read when the slice count array is accessed. Although no firmware currently exhibits this behavior, validating the slice count array is essential for robustness and security.
How To Fix
Minimum fixed version
6.8.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it becomes available to mitigate any potential risks.
Conclusion
The identified vulnerability in the Linux kernel related to the crypto: qat feature poses a significant risk due to the potential for out of bounds memory reads. It is essential for users of Debian 13 and 14 to update their systems to the patched version 6.8.12-1 to ensure security and stability. Regular monitoring using tools like Vulert can help maintain awareness of vulnerabilities.
See every vulnerability recorded for linux →
FAQ
The vulnerability is an out of bounds memory read that could occur if the firmware returns an incorrect slice count array.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
If exploited, this vulnerability could lead to unauthorized access to memory, potentially allowing attackers to read sensitive information or crash the system.
Yes, the patched version of the Linux kernel is 6.8.12-1 for both Debian 13 and 14.
While there are no specific workarounds, it is crucial to prioritize updating your system to mitigate risks associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
