Kernel Panic Risk in Linux Package Due to Uninitialized Queue Vectors
Summary
DEBIAN-CVE-2024-42113: In the Linux kernel, the following vulnerability has been resolved: net: txgbe: initialize num_q_vectors for MSI/INTx interrupts When using MSI/INTx interrupts, wx->num_q_vectors is uninitialized. Affects linux versions < 6.9.9-1. Fixed in 6.9.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It serves as the foundation for various applications and services, ensuring efficient operation and performance. However, vulnerabilities in the Linux kernel can lead to severe system instability and security risks, making it crucial to address any identified issues promptly.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the txgbe driver, specifically concerning the initialization of num_q_vectors for MSI/INTx interrupts. When these interrupts are used, the wx->num_q_vectors variable remains uninitialized, leading to a potential kernel panic during the allocation of queue vectors in the wx_alloc_q_vectors() function. This can result in system crashes and loss of service, posing significant risks to system stability and security.
How To Fix
Minimum fixed version
6.9.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workaround has been provided for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate the risks associated with the uninitialized queue vectors.
Conclusion
The identified vulnerability in the Linux kernel poses a significant risk of kernel panic due to uninitialized queue vectors. It is essential for users to update to the patched version 6.9.9-1 to mitigate this risk. Regular monitoring and prompt updates are critical for maintaining system stability and security.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to kernel panic, causing the system to crash and potentially resulting in data loss or service interruption.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
While there is no specific workaround, it is advisable to monitor the system closely for any signs of instability and plan for an update as soon as possible.
Yes, this vulnerability affects the Linux package in Debian versions 13 and 14, specifically those versions prior to 6.9.9-1.
Detailed information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-42113.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
