Critical Vulnerability in Linux Kernel: drm/xe PAT Settings Dump Issue
Summary
DEBIAN-CVE-2024-42091: In the Linux kernel, the following vulnerability has been resolved: drm/xe: Check pat.ops before dumping PAT settings We may leave pat.ops unset when running on brand new platform or when running as a VF. Affects linux versions < 6.9.8-1. Fixed in 6.9.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system operations. It is widely used across various platforms, including servers, desktops, and embedded systems. This vulnerability affects the Linux kernel versions in Debian 13 and 14, specifically related to the Direct Rendering Manager (DRM) and its handling of the Page Attribute Table (PAT) settings, which are crucial for memory management and performance optimization.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the drm/xe component where the pat.ops pointer may remain unset when operating on a new platform or as a Virtual Function (VF). This can lead to a Null Pointer Dereference (NPD) when attempting to dump PAT settings via debugfs, potentially causing system crashes or instability. The issue arises from the failure to check the validity of the pat.ops pointer before accessing it, which is critical for ensuring safe operations.
How To Fix
Minimum fixed version
6.9.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate the risk.
Conclusion
The identified vulnerability in the Linux kernel's drm/xe component poses a significant risk due to the potential for system crashes when dumping PAT settings. It is essential for users to update to the patched version 6.9.8-1 to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a Null Pointer Dereference (NPD) in the Linux kernel's drm/xe component, which can lead to system crashes when dumping PAT settings.
The vulnerability affects the Linux kernel versions in Debian 13 and 14 prior to the fixed version 6.9.8-1.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to avoid potential system instability.
Detailed information about the vulnerability can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-42091.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
