Intel Virtual Button Notify Handler Race Condition in Linux Package
Summary
DEBIAN-CVE-2024-44937: In the Linux kernel, the following vulnerability has been resolved: platform/x86: intel-vbtn: Protect ACPI notify handler against recursion Since commit e2ffcda16290 ("ACPI: OSL: Allow Notify () handlers to run on all CP... Affects linux versions < 6.10.6-1. Fixed in 6.10.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing the essential kernel that manages system resources and hardware interactions. It is responsible for facilitating communication between software applications and hardware devices. This package is critical for system stability and performance, and vulnerabilities within it can lead to significant security risks and operational failures.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the intel-vbtn notify handler, which is responsible for handling ACPI notifications related to virtual buttons on devices like the Dell Venue 7140 tablet. The issue arises from a race condition that occurs when the notify handler is invoked on multiple CPU cores simultaneously. This can lead to the handler attempting to register the same device multiple times, resulting in errors such as duplicate filenames in sysfs and potential kernel NULL pointer dereferences. The vulnerability originated from a change made in commit e2ffcda16290, which allowed notify handlers to run on all CPUs without adequate protection against concurrent execution.
How To Fix
Minimum fixed version
6.10.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate the risks associated with this issue.
Conclusion
The vulnerability in the intel-vbtn notify handler poses significant risks to systems running the affected versions of the Linux package. It is essential for users to update to the patched version to ensure system stability and security. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system instability, crashes, and potential data loss due to kernel errors caused by race conditions.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. By uploading your manifest file, you can check if your application is affected by this vulnerability.
Yes, due to potential kernel crashes and instability, there is a risk of data loss if the vulnerability is exploited.
While there are no specific workarounds, it is crucial to prioritize updating the package to mitigate risks as soon as possible.
Detailed information can be found in the Debian CVE database and through security advisories related to the Linux package.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
