Critical Vulnerability in Linux Kernel: TCP-AO Static Key Management Issue
Summary
DEBIAN-CVE-2024-43887: In the Linux kernel, the following vulnerability has been resolved: net/tcp: Disable TCP-AO static key after RCU grace period The lifetime of TCP-AO static_key is the same as the last tcp_ao_info. Affects linux versions < 6.10.6-1. Fixed in 6.10.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, managing hardware and system resources. It provides essential services for all other software running on the system. This vulnerability affects the Linux kernel versions in Debian 13 and 14, specifically related to the TCP-AO (TCP Authentication Option) static key management, which is crucial for secure TCP connections.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified concerning the management of the TCP-AO static key. The issue arises from the static key's lifetime being tied to the tcp_ao_info structure, which can lead to race conditions during socket destruction. If the RCU grace period is delayed, other CPUs may access a tcp_ao_info that is in the process of being disabled, leading to potential kernel crashes and undefined behavior. This vulnerability was introduced in commit eb8c507296f6 and has been confirmed through testing, indicating that it is not merely theoretical.
How To Fix
Minimum fixed version
6.10.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The identified vulnerability in the Linux kernel regarding TCP-AO static key management poses significant risks, including potential kernel crashes. It is crucial for users of Debian 13 and 14 to update to the patched version 6.10.6-1 to mitigate these risks. Regular monitoring and timely updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper management of the TCP-AO static key, which can lead to race conditions and potential kernel crashes.
The vulnerability affects Linux kernel versions in Debian 13 and 14 prior to the fixed version 6.10.6-1.
You can use Vulert, which monitors open-source vulnerabilities in your software. By using the manifest file like package-lock.json, it can alert you in real-time. You can also check your application using the Vulert playground without signup.
While there are no specific workarounds, it is advisable to monitor your system for any unusual behavior and apply the update as soon as possible.
More details can be found in the official Debian CVE database or by checking the Linux kernel mailing lists and security advisories.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
