Critical NULL Pointer Dereference Vulnerability in Linux Kernel - gfs2 Package
Summary
DEBIAN-CVE-2024-42079: In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix NULL pointer dereference in gfs2_log_flush In gfs2_jindex_free(), set sdp->sd_jdesc to NULL under the log flush lock to provide exclusion agai... Affects linux versions < 6.9.8-1. Fixed in 6.9.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, including Debian. It manages system resources and hardware communication, providing essential services for software applications. The gfs2 package is a clustered file system that allows multiple nodes to share a single file system. This vulnerability affects the gfs2 implementation within the Linux kernel, potentially leading to system instability and crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the gfs2 file system related to a NULL pointer dereference. This issue arises in the gfs2_log_flush function, where the code does not adequately check if the sd_jdesc pointer is non-NULL before dereferencing it. This oversight can lead to a system crash if outstanding glock work races with an unmount operation, resulting in a NULL pointer dereference. The vulnerability is critical as it can compromise system stability and lead to data loss.
How To Fix
Minimum fixed version
6.9.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The recommended action is to apply the patch by updating to the fixed version of the Linux package.
Conclusion
The identified NULL pointer dereference vulnerability in the gfs2 implementation of the Linux kernel poses significant risks to system stability. Users are advised to update their Linux packages to the patched version 6.9.8-1 to protect against potential crashes and data loss. Regular monitoring with tools like Vulert can help maintain awareness of vulnerabilities in open-source software.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a NULL pointer dereference in the gfs2_log_flush function of the Linux kernel, which can lead to system crashes.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
If exploited, this vulnerability can cause system instability, crashes, and potential data loss, impacting the overall functionality of the system.
Yes, a patch is available in version 6.9.8-1 of the Linux package for Debian 13 and 14.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risks associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
