Critical Stack Buffer Vulnerability in Linux Package - CVE-2024-39478
Summary
DEBIAN-CVE-2024-39478: In the Linux kernel, the following vulnerability has been resolved: crypto: starfive - Do not free stack buffer RSA text data uses variable length buffer allocated in software stack. Affects linux versions < 6.9.7-1. Fixed in 6.9.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It serves as the foundation for various applications and services, ensuring efficient operation and security. This vulnerability specifically affects the crypto subsystem of the Linux kernel, which handles cryptographic operations, making it crucial for secure communications and data protection.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the crypto subsystem related to the starfive implementation. The issue arises from the use of a variable-length buffer allocated on the software stack for RSA text data. When the function kfree is called on this buffer, it leads to undefined behavior in subsequent operations, potentially allowing attackers to exploit this flaw for malicious purposes, such as executing arbitrary code or causing system crashes.
How To Fix
Minimum fixed version
6.9.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the available patch as soon as possible.
Conclusion
The CVE-2024-39478 vulnerability in the Linux kernel poses significant risks to systems running affected versions of the Linux package. Users are strongly encouraged to update to the patched version 6.9.7-1 to ensure their systems remain secure. Monitoring tools like Vulert can assist in identifying vulnerabilities in your applications.
See every vulnerability recorded for linux →
FAQ
CVE-2024-39478 is a vulnerability in the Linux kernel's crypto subsystem that can lead to undefined behavior due to improper handling of a stack buffer.
This vulnerability can potentially allow attackers to execute arbitrary code or crash the system, compromising its security and stability.
If you are using Debian versions 13 or 14 with the Linux package prior to version 6.9.7-1, your system is vulnerable.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities in real-time.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risk associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
