Integer Overflow Vulnerability in Linux Kernel Package: linux (Debian 13 & 14)
Summary
DEBIAN-CVE-2024-42066: In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix potential integer overflow in page size calculation Explicitly cast tbo->page_alignment to u64 before bit-shifting to prevent overflow when... Affects linux versions < 6.9.8-1. Fixed in 6.9.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'linux' package is the core of the Debian operating system, providing essential functionalities for hardware interaction and system management. It serves as the foundation for various applications and services, ensuring stability and performance. However, vulnerabilities within the kernel can have significant implications, affecting system security and reliability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the Direct Rendering Manager (drm) subsystem. Specifically, an integer overflow can occur during the calculation of page size due to improper casting of the 'tbo->page_alignment' variable. This oversight can lead to incorrect memory allocation, potentially resulting in system crashes or exploitation by malicious entities. The vulnerability is documented as DEBIAN-CVE-2024-42066 and affects versions prior to 6.9.8-1.
How To Fix
Minimum fixed version
6.9.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The recommended action is to apply the patch by updating the package.
Conclusion
The integer overflow vulnerability in the Linux kernel's DRM subsystem poses a significant risk to system security. Users are strongly advised to update their 'linux' package to version 6.9.8-1 or later to protect their systems from potential exploitation. Regular monitoring and updates are essential for maintaining system integrity.
See every vulnerability recorded for linux →
FAQ
The vulnerability is an integer overflow in the Linux kernel's DRM subsystem, which can lead to incorrect memory allocation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could lead to system crashes or allow attackers to execute arbitrary code.
Yes, a patch is available in version 6.9.8-1 of the 'linux' package.
While there are no specific workarounds, it is crucial to prioritize updating the package as soon as possible to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
