Critical NULL Pointer Dereference Vulnerability in Linux Kernel Package
Summary
DEBIAN-CVE-2024-42235: In the Linux kernel, the following vulnerability has been resolved: s390/mm: Add NULL pointer check to crst_table_free() base_crst_free() crst_table_free() used to work with NULL pointers before the conversion to ptdescs... Affects linux versions < 6.9.10-1. Fixed in 6.9.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the Debian operating system, responsible for managing hardware resources and providing essential services to applications. It is known for its stability, performance, and security features. However, like any complex software, it can be susceptible to vulnerabilities that may compromise system integrity and security. This specific vulnerability affects the memory management functions within the kernel, particularly in the s390 architecture.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified where the function crst_table_free() does not adequately check for NULL pointers. This oversight can lead to potential crashes or undefined behavior if the function is invoked with a NULL argument. The issue arises during error handling in the crst_table_upgrade() function, where an explicit check for NULL pointers was not implemented. Although this situation is unlikely to occur under normal conditions, it poses a risk if certain allocation failures are triggered, especially when FAIL_PAGE_ALLOC is enabled.
How To Fix
Minimum fixed version
6.9.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds recommended for this vulnerability other than applying the patch. Users should ensure their systems are regularly updated to maintain security.
Conclusion
The identified NULL pointer dereference vulnerability in the Linux kernel poses a risk to system stability and security. Users are strongly advised to update their kernel packages to the patched version 6.9.10-1 to safeguard against potential exploits. Regular updates and monitoring are essential for maintaining a secure environment.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes or undefined behavior if the affected functions are called with NULL pointers.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Yes, this vulnerability specifically affects the s390 architecture within the Linux kernel.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risk.
Detailed information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-42235.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
