Kernel Crash Vulnerability in Linux Package: Improper Handling of Extts Events
Summary
DEBIAN-CVE-2024-42139: In the Linux kernel, the following vulnerability has been resolved: ice: Fix improper extts handling Extts events are disabled and enabled by the application ts2phc. Affects linux versions < 6.9.9-1. Fixed in 6.9.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It provides essential services such as process management, memory management, and device control. The kernel is highly modular, allowing for the addition of various drivers and functionalities. However, vulnerabilities can arise, impacting system stability and security. This specific vulnerability affects the Linux package in Debian versions 13 and 14, highlighting a flaw in the handling of extts events within the ice driver.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the ice driver related to the handling of extts events. When the application ts2phc is running, extts events can be enabled or disabled. However, if the driver is removed while the application is still active, a specific extts event may remain enabled, leading to a potential kernel crash. This issue can cause instability in the system, as the message 'extts on unexpected channel' may be printed to the user when the driver is reloaded and the application is restarted. The root cause lies in the failure to properly disable extts events when the Precision Time Protocol (PTP) is released.
How To Fix
Minimum fixed version
6.9.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid removing the driver while the application ts2phc is running. This may help prevent the extts event from remaining enabled and causing a kernel crash.
Conclusion
The vulnerability in the Linux kernel regarding improper handling of extts events poses a significant risk to system stability. Users are encouraged to update to the patched version to mitigate this risk. Additionally, employing Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper handling of extts events in the ice driver, which can lead to a kernel crash if the driver is removed while the application is running.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading a manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
Failure to address this vulnerability may result in system instability, crashes, and potential data loss, especially if the affected application is critical to system operations.
Yes, the vulnerability is fixed in version 6.9.9-1 and later for both Debian 13 and 14.
Detailed information can be found in the Debian CVE database, and you can also explore Vulert for real-time monitoring of vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
