Critical Vulnerability in Linux Kernel: Descriptor Validation Flaw in ENA Driver
Summary
DEBIAN-CVE-2024-40999: In the Linux kernel, the following vulnerability has been resolved: net: ena: Add validation for completion descriptors consistency Validate that first flag is set only for the first descriptor in multi-buffer packets. Affects linux versions < 6.9.7-1. Fixed in 6.9.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It is known for its robustness and versatility, supporting a wide range of devices and applications. However, vulnerabilities can arise, affecting system stability and security. The specific issue at hand involves the Elastic Network Adapter (ENA) driver, which requires validation of completion descriptors to prevent data corruption.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2024-40999 pertains to the ENA driver within the Linux kernel. It arises from inadequate validation of completion descriptors, specifically the 'first' flag, which should only be set for the first descriptor in multi-buffer packets. If an invalid descriptor is encountered, it triggers a reset, potentially leading to RX data corruption. This flaw could compromise data integrity and system performance, making it critical to address.
How To Fix
Minimum fixed version
6.9.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The vulnerability DEBIAN-CVE-2024-40999 in the Linux kernel's ENA driver poses a significant risk due to improper validation of completion descriptors. Users are urged to update to the patched version 6.9.7-1 to mitigate potential data corruption and system instability. Regular monitoring and prompt updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
It is a vulnerability in the Linux kernel related to the ENA driver that affects the validation of completion descriptors.
It can lead to RX data corruption and potentially impact system stability and performance.
Yes, the patched version is 6.9.7-1 for both Debian 13 and 14.
You can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in your software without requiring code access.
While there are no specific workarounds, it is advisable to monitor your system for unusual behavior and apply the patch as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
