Critical Vulnerability in Linux Package: Unregistered UCSI Callback in Atomic Context
Summary
DEBIAN-CVE-2024-46691: In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Move unregister out of atomic section Commit '9329933699b3 ("soc: qcom: pmic_glink: Make client-lock non-sleeping")' moved the pmic_gl... Affects linux versions < 6.10.9-1. Fixed in 6.10.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for hardware interaction and system management. It is widely used across various distributions and is known for its robust performance and extensive hardware support. However, it is susceptible to vulnerabilities that can affect system stability and security, as seen in this specific issue.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the UCSI (USB Type-C Connector System Interface) where the ucsi_unregister() function is called from an atomic context due to a change in the pmic_glink client list management. This change, introduced by commit '9329933699b3', moved the client list under a spinlock, which is accessed by an IRQ context callback. As a result, ucsi_unregister() is invoked in a non-sleepable context, leading to potential NULL pointer dereferences if the remote processor communication link is lost. This can cause system instability and errors logged in the kernel.
How To Fix
Minimum fixed version
6.10.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there is no specific workaround provided for this vulnerability. However, users should monitor their kernel logs for any errors related to UCSI communication and ensure that their systems are updated to the latest version to mitigate risks.
Conclusion
The vulnerability in the Linux package regarding the UCSI callback presents significant risks to system stability and security. Users are strongly encouraged to update to the patched version to mitigate these risks. Regular monitoring and updates are essential for maintaining system integrity.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves the ucsi_unregister() function being called from an atomic context, which can lead to NULL pointer dereferences and system instability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability can lead to system crashes, instability, and errors in the kernel logs, affecting overall system performance.
Yes, a patch is available in version 6.10.9-1 of the Linux package. Users should update to this version or later.
While there is no specific workaround, it is advisable to monitor kernel logs for related errors and plan to update your system as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
