Kernel Panic Vulnerability in Linux Package: External Timestamp Event Race Condition
Summary
DEBIAN-CVE-2024-42107: In the Linux kernel, the following vulnerability has been resolved: ice: Don't process extts if PTP is disabled The ice_ptp_extts_event() function can race with ice_ptp_release() and result in a NULL pointer dereference... Affects linux versions < 6.9.9-1. Fixed in 6.9.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is a core component of the operating system that manages hardware and system resources. It provides essential services for all other parts of the system, including process management, memory management, and device control. The kernel is crucial for system stability and performance. This vulnerability affects the 'linux' package in Debian versions 13 and 14, specifically in the ice driver responsible for handling Precision Time Protocol (PTP) functionalities.
Vulnerability Detail
In the Linux kernel, a race condition exists in the ice_ptp_extts_event() function, which can lead to a NULL pointer dereference and subsequently a kernel panic. This occurs when the ice driver releases the PTP clock before the interrupt for the next external timestamp event is processed. As a result, the function attempts to call ptp_clock_event() with a NULL pointer, causing the system to crash. This vulnerability can lead to system instability and potential data loss.
How To Fix
Minimum fixed version
6.9.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, ensuring that the PTP functionality is properly managed and monitored can help mitigate potential issues until the patch is applied.
Conclusion
The identified vulnerability in the Linux kernel related to the ice driver can lead to serious system instability due to a race condition causing kernel panic. It is crucial for users to update to the patched version 6.9.9-1 to mitigate this risk. Regular monitoring and using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to a kernel panic, causing the system to crash and potentially resulting in data loss.
The vulnerability affects the Linux package in Debian versions 13 and 14.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Yes, a patch is available in version 6.9.9-1 of the Linux package.
While there are no specific workarounds, it is advisable to monitor the PTP functionality closely until the patch can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
