Critical NULL Pointer Dereference in Linux Kernel - Package: linux
Summary
DEBIAN-CVE-2024-43911: In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix NULL dereference at band check in starting tx ba session In MLD connection, link_data/link_conf are dynamically allocated. Affects linux versions < 6.10.6-1. Fixed in 6.10.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The linux package is a core component of the Debian operating system, providing essential functionalities for hardware interaction and system management. It serves as the foundation for running applications and managing system resources. The vulnerability in question affects the kernel's handling of wireless connections, specifically in the mac80211 subsystem, which is responsible for managing Wi-Fi connections.
Vulnerability Detail
In the Linux kernel, a critical vulnerability has been identified that leads to a NULL pointer dereference during the initiation of a transmission block acknowledgment (tx ba) session in the mac80211 subsystem. This issue arises when link_data and link_conf are dynamically allocated but do not correctly point to vif->bss_conf, resulting in a NULL channel request. The vulnerability can cause a system crash, leading to denial of service. The crash log indicates that the kernel attempts to access a NULL address, triggering a kernel panic and potentially affecting system stability.
How To Fix
Minimum fixed version
6.10.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patch as soon as possible.
Conclusion
The identified vulnerability in the Linux kernel's handling of Wi-Fi connections poses a significant risk, leading to potential system crashes. Users are strongly encouraged to update their linux package to the patched version 6.10.6-1 to ensure system stability and security.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to a system crash due to a NULL pointer dereference, resulting in a denial of service.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Yes, a patch is available in version 6.10.6-1 of the linux package. Updating to this version will resolve the issue.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risk of system crashes.
More details can be found in the Debian CVE database or by visiting the vulnerability report at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-43911.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
