Kernel Oops Vulnerability in Linux Package: Power Supply Driver Issue
Summary
DEBIAN-CVE-2024-44936: In the Linux kernel, the following vulnerability has been resolved: power: supply: rt5033: Bring back i2c_set_clientdata Commit 3a93da231c12 ("power: supply: rt5033: Use devm_power_supply_register() helper") reworked the... Affects linux versions < 6.10.6-1. Fixed in 6.10.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system, responsible for managing hardware and system resources. The 'linux' package in Debian distributions provides the kernel necessary for the system's operation. This package is crucial for ensuring that all hardware components communicate effectively with the software. The vulnerability in question arises from a modification in the power supply driver for the rt5033 component, which is responsible for managing power supply functions in devices. The change inadvertently removed necessary functionality, leading to system instability.
Vulnerability Detail
In the Linux kernel, a vulnerability was introduced when the power supply driver for the rt5033 was modified to use the devm_power_supply_register() helper. During this rework, the i2c_set_clientdata function was dropped, along with the remove callback. This omission caused other parts of the driver to fail, leading to kernel oops errors. The ramifications of this vulnerability include potential system crashes and instability, as the driver fails to manage power supply data correctly, which can disrupt the operation of devices relying on this driver.
How To Fix
Minimum fixed version
6.10.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the package as described above.
Conclusion
The vulnerability in the Linux kernel's power supply driver for the rt5033 component poses significant risks to system stability. Users are advised to update their 'linux' package to the latest version to mitigate these risks. Utilizing tools like Vulert can help in monitoring for such vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
The vulnerability is related to the power supply driver in the Linux kernel, which can cause kernel oops errors due to missing functionality.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failure to fix this vulnerability may lead to system crashes and instability, particularly for devices relying on the affected power supply driver.
Yes, you should update to version 6.10.6-1 or later to ensure that the vulnerability is patched.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
