Kernel Vulnerability in Linux Package: ELF_HWCAP2 AUX Vector Calculation Issue
Summary
DEBIAN-CVE-2024-46684: In the Linux kernel, the following vulnerability has been resolved: binfmt_elf_fdpic: fix AUXV size calculation when ELF_HWCAP2 is defined create_elf_fdpic_tables() does not correctly account the space for the AUX vector... Affects linux versions < 6.10.9-1. Fixed in 6.10.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It supports a wide range of functionalities, including process management, memory management, and device control. This vulnerability specifically affects the handling of the AUX vector in ELF binaries when the ELF_HWCAP2 feature is defined, potentially leading to system instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the binfmt_elf_fdpic functionality, where the AUX vector size calculation is incorrect when ELF_HWCAP2 is defined. This flaw can lead to a kernel BUG, causing system crashes or unexpected behavior. The issue originates from the create_elf_fdpic_tables() function, which fails to account for the correct number of AUXV entries, resulting in the last entry being erroneously set to zero. The vulnerability was introduced prior to the commit 10e29251be0e, which attempted to fix the AUX vector but inadvertently introduced a new bug.
How To Fix
Minimum fixed version
6.10.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate any risks.
Conclusion
The vulnerability identified in the Linux kernel regarding the AUX vector size calculation poses significant risks to system stability. It is essential for users to update their systems to the patched version to ensure security and functionality. Monitoring tools like Vulert can assist in identifying vulnerabilities in open-source software.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to kernel crashes or unexpected behavior in systems that utilize ELF binaries with the ELF_HWCAP2 feature.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Yes, a patch is available in version 6.10.9-1 of the Linux package. Updating to this version will resolve the vulnerability.
While there are no specific workarounds, it is crucial to monitor the situation and apply the patch as soon as possible to mitigate risks.
More details can be found in the Debian CVE database or by visiting the official Linux kernel documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
