Critical Race Condition Vulnerability in Linux Kernel Package
Summary
DEBIAN-CVE-2024-41054: In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix ufshcd_clear_cmd racing issue When ufshcd_clear_cmd is racing with the completion ISR, the completed tag of the request's mq_hctx p... Affects linux versions < 6.9.10-1. Fixed in 6.9.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware resources and providing essential services to applications. It is a highly complex and critical software package that supports a wide range of devices and functionalities. This vulnerability specifically affects the SCSI UFS (Universal Flash Storage) subsystem, which is responsible for managing storage devices. The issue arises from a race condition that can lead to a kernel panic, potentially causing system instability and data loss.
Vulnerability Detail
In the Linux kernel, a race condition exists in the SCSI UFS core, specifically in the ufshcd_clear_cmd function. This vulnerability occurs when ufshcd_clear_cmd races with the completion interrupt service routine (ISR), resulting in a NULL pointer dereference. When the ISR completes a request, it sets the request's mq_hctx pointer to NULL. If ufshcd_clear_cmd is called during this time, it attempts to access the NULL pointer, leading to a kernel panic. This can cause system crashes and data corruption, making it a critical vulnerability that needs immediate attention.
How To Fix
Minimum fixed version
6.9.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The identified race condition vulnerability in the Linux kernel poses significant risks to system stability and data integrity. It is crucial for users to update to the patched version 6.9.10-1 to mitigate these risks. Utilizing tools like Vulert can aid in ongoing vulnerability management.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to a kernel panic, causing system crashes and potential data loss.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
While there are no specific workarounds, it is recommended to minimize system usage until the patch can be applied.
This vulnerability specifically affects versions prior to 6.9.10-1. If you are running an earlier version, you are at risk.
Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
