Out-of-Bounds Access Vulnerability in Linux Kernel Package: linux
Summary
DEBIAN-CVE-2024-39462: In the Linux kernel, the following vulnerability has been resolved: clk: bcm: dvp: Assign ->num before accessing ->hws Commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with counted_by") annotated the hws me... Affects linux versions < 6.9.7-1. Fixed in 6.9.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'linux' package is a core component of the Debian operating system, providing the Linux kernel that serves as the foundation for the system's functionality. It manages hardware resources, system calls, and provides essential services for applications. This package is critical for system stability and security, making it vital to address any vulnerabilities that may arise.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the improper initialization of the 'num' member in the 'struct clk_hw_onecell_data'. This issue arises in the clk_dvp_probe() function, where the 'hws' array is accessed before 'num' is assigned, leading to potential out-of-bounds access. This can trigger warnings from the bounds sanitizer, indicating that the index is out of range. The specific commit f316cdff8d67 introduced this issue by annotating the 'hws' member without ensuring proper initialization beforehand.
How To Fix
Minimum fixed version
6.9.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate any risks associated with the out-of-bounds access.
Conclusion
The vulnerability identified in the Linux kernel package 'linux' poses a risk of out-of-bounds access due to improper initialization. It is crucial to update to the patched version 6.9.7-1 to mitigate this risk. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves out-of-bounds access in the Linux kernel due to improper initialization of the 'num' member in a data structure.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
If exploited, this vulnerability could lead to system instability, crashes, or unauthorized access to system resources.
Yes, a patch is available in version 6.9.7-1 of the 'linux' package. It is recommended to update to this version or later.
You can use Vulert to receive real-time alerts for open-source vulnerabilities in your software without needing to install additional tools.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
