Critical NULL Pointer Dereference in Linux Kernel - linux Package Vulnerability
Summary
DEBIAN-CVE-2024-42065: In the Linux kernel, the following vulnerability has been resolved: drm/xe: Add a NULL check in xe_ttm_stolen_mgr_init Add an explicit check to ensure that the mgr is not NULL. Affects linux versions < 6.9.8-1. Fixed in 6.9.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux package is a core component of the Debian operating system, providing the essential kernel that manages system resources and hardware interactions. It is responsible for enabling the execution of applications, managing memory, and handling device drivers. The security and stability of the linux package are crucial for the overall performance and reliability of Debian systems.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the drm/xe module, specifically related to the xe_ttm_stolen_mgr_init function. This issue arises from a lack of a NULL pointer check, which could lead to a NULL pointer dereference. If exploited, this vulnerability could result in system crashes or unexpected behavior, impacting the stability and security of the operating system. The vulnerability has been assigned the identifier DEBIAN-CVE-2024-42065 and affects both Debian 13 and 14 versions of the linux package.
How To Fix
Minimum fixed version
6.9.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is advisable to apply the patch as soon as it becomes available.
Conclusion
The vulnerability identified as DEBIAN-CVE-2024-42065 poses a significant risk to systems running the linux package in Debian 13 and 14. It is essential to apply the available patch to ensure system stability and security. Users are encouraged to monitor their systems and utilize tools like Vulert for real-time vulnerability alerts.
See every vulnerability recorded for linux →
FAQ
DEBIAN-CVE-2024-42065 is the identifier for a vulnerability in the Linux kernel related to a NULL pointer dereference in the drm/xe module.
This vulnerability can lead to system crashes or unexpected behavior, compromising the stability and security of your operating system.
If you are using Debian 13 or 14 with the linux package version prior to 6.9.8-1, your system is vulnerable.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
While there are no specific workarounds available, it is crucial to plan for an update as soon as possible to mitigate the risk associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
