Critical Runtime PM Protection Vulnerability in Linux Kernel Package
Summary
DEBIAN-CVE-2024-42146: In the Linux kernel, the following vulnerability has been resolved: drm/xe: Add outer runtime_pm protection to xe_live_ktest@xe_dma_buf Any kunit doing any memory access should get their own runtime_pm outer references s... Affects linux versions < 6.9.9-1. Fixed in 6.9.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It is widely used across various platforms, including servers, desktops, and embedded systems. The kernel's functionality includes process management, memory management, device drivers, and system calls. This vulnerability specifically affects the Linux kernel versions in Debian 13 and 14, which could lead to improper handling of runtime power management, potentially causing system instability or crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the drm/xe subsystem, specifically related to the lack of outer runtime power management (PM) protection in the xe_live_ktest@xe_dma_buf function. This issue arises when kunit tests perform memory access without the necessary runtime PM references, which can lead to warnings and potential system instability. The vulnerability was discovered during pre-merge continuous integration testing, highlighting the importance of proper PM management in driver development.
How To Fix
Minimum fixed version
6.9.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it becomes available to mitigate any risks associated with this issue.
Conclusion
The identified vulnerability in the Linux kernel's drm/xe subsystem poses a significant risk due to the lack of outer runtime PM protection. It is crucial for users of Debian 13 and 14 to update their systems to the patched version 6.9.9-1 to mitigate potential issues. Utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves missing outer runtime PM protection in the Linux kernel's drm/xe subsystem, which can lead to system instability.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
If exploited, this vulnerability could lead to system crashes or instability due to improper memory access management.
Yes, a patch is available in version 6.9.9-1 of the Linux kernel. It is recommended to update to this version or later.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
