Critical Vulnerability in Linux Package: Scheduling While Atomic Issue
Summary
DEBIAN-CVE-2024-46678: In the Linux kernel, the following vulnerability has been resolved: bonding: change ipsec_lock from spin lock to mutex In the cited commit, bond->ipsec_lock is added to protect ipsec_list, hence xdo_dev_state_add and xdo... Affects linux versions < 6.10.9-1. Fixed in 6.10.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It is widely used in various environments, from servers to personal computers. This package is known for its stability and performance, but like any software, it can be susceptible to vulnerabilities that may affect system integrity and security.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the bonding feature, specifically concerning the ipsec_lock mechanism. The issue arises from the use of a spin lock instead of a mutex for ipsec_lock, which can lead to a 'scheduling while atomic' error when the active slave of a bond is changed. This can cause system instability and crashes, as operations that may sleep are incorrectly handled while the system is in an atomic state. The vulnerability is documented under DEBIAN-CVE-2024-46678.
How To Fix
Minimum fixed version
6.10.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid changing the active slave of a bond while the system is under heavy load or performing critical operations to prevent triggering the scheduling issue. However, this is not a permanent solution and updating the package is strongly advised.
Conclusion
The vulnerability identified in the Linux package poses significant risks to system stability and security. It is crucial for users to update to the patched version 6.10.9-1 to mitigate these risks. Utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves a scheduling issue caused by using a spin lock instead of a mutex in the Linux kernel's bonding feature.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. By uploading your manifest file, you can check for vulnerabilities without needing to install any software.
Failing to address this vulnerability can lead to system crashes, instability, and potential data loss, especially in environments where the Linux kernel is critical for operations.
Yes, the patched version of the Linux package is 6.10.9-1. Updating to this version will resolve the vulnerability.
Detailed information can be found in the official Debian CVE database or by visiting the Vulert website for real-time monitoring of vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
