Critical DMA Direction Vulnerability in Linux Kernel Package: linux
Summary
DEBIAN-CVE-2024-43881: In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: change DMA direction while mapping reinjected packets For fragmented packets, ath12k reassembles each fragment as a normal packet and then... Affects linux versions < 6.10.3-1. Fixed in 6.10.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. It manages system resources and enables communication between hardware and applications. The linux package in Debian is crucial for system stability and performance, making it vital for users to maintain its integrity and security. This vulnerability affects versions of the linux package in Debian 13 and 14, highlighting the importance of timely updates to safeguard systems.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified in the ath12k driver related to the handling of DMA (Direct Memory Access) directions during the reinjection of fragmented packets. When reassembling fragmented packets, the driver incorrectly set the DMA direction to DMA_FROM_DEVICE instead of the correct DMA_TO_DEVICE. This misconfiguration could lead to the reinjection of invalid payloads into the hardware, potentially exposing sensitive information from arbitrary memory allocated to the skb (socket buffer) and increasing the risk of data leakage.
How To Fix
Minimum fixed version
6.10.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workaround has been provided for this vulnerability. The best course of action is to apply the available patch as soon as possible.
Conclusion
The identified vulnerability in the Linux kernel's ath12k driver poses a significant risk of data leakage due to improper DMA direction handling. Users of the linux package in Debian 13 and 14 should promptly update to version 6.10.3-1 or later to protect their systems from potential exploitation.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves an incorrect DMA direction setting in the ath12k driver, which could lead to the reinjection of invalid payloads and potential data leakage.
The vulnerability affects the linux package in Debian versions 13 and 14 prior to the patched version 6.10.3-1.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
While no specific workaround is available, it is recommended to prioritize the update to mitigate the risk associated with this vulnerability.
Detailed information can be found in the Debian CVE database and through security advisories related to the linux package.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
