Out-of-Bounds Access Vulnerability in Linux Kernel - linux Package
Summary
DEBIAN-CVE-2024-39461: In the Linux kernel, the following vulnerability has been resolved: clk: bcm: rpi: Assign ->num before accessing ->hws Commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with counted_by") annotated the hws me... Affects linux versions < 6.9.7-1. Fixed in 6.9.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The linux package is a core component of the Debian operating system, providing the essential kernel that manages system resources and hardware interactions. It is crucial for the stability and performance of the system, supporting a wide range of functionalities from process management to device control. This specific vulnerability affects the Raspberry Pi clock management, potentially leading to system instability or crashes if exploited.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the improper initialization of the 'num' member in the 'struct clk_hw_onecell_data'. This issue arises when the 'hws' member is accessed before 'num' is assigned, leading to out-of-bounds access warnings. The vulnerability was introduced in commit f316cdff8d67, where the bounds sanitizer is unable to correctly assess the number of elements in 'hws' prior to initialization. This can result in undefined behavior and may allow an attacker to exploit the system by accessing memory that is not allocated for 'hws'.
How To Fix
Minimum fixed version
6.9.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
The identified vulnerability in the Linux kernel's clock management for Raspberry Pi poses significant risks to system stability and security. It is crucial for users to update their linux package to the latest version to mitigate these risks. Regular monitoring and prompt application of patches are essential practices for maintaining system integrity.
See every vulnerability recorded for linux →
FAQ
The vulnerability is an out-of-bounds access issue in the Linux kernel related to clock management for Raspberry Pi.
Exploitation of this vulnerability could lead to system instability, crashes, or unauthorized access to memory.
Yes, a patch is available in version 6.9.7-1 of the linux package.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
While there are no specific workarounds, it is recommended to monitor the system closely and apply the patch as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
