Critical NULL Pointer Dereference in Linux Kernel's sysfb_disable() - linux Package
Summary
DEBIAN-CVE-2024-46698: In the Linux kernel, the following vulnerability has been resolved: video/aperture: optionally match the device in sysfb_disable() In aperture_remove_conflicting_pci_devices(), we currently only call sysfb_disable() on v... Affects linux versions < 6.10.9-1. Fixed in 6.10.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux package is a core component of the Debian operating system, providing the Linux kernel that manages hardware resources and system processes. It is essential for system stability and performance. This package is frequently updated to address security vulnerabilities and improve functionality. The vulnerability in question affects the handling of display devices, particularly when non-VGA class devices are used as primary display outputs.
Vulnerability Detail
In the Linux kernel, a vulnerability exists in the function sysfb_disable() related to the handling of display devices. When a non-VGA class PCI device is used as the boot display, sysfb_disable() is not called, leading to a NULL pointer dereference when resources are freed by aperture_detach_platform_device(). This can result in system crashes or instability, particularly when a secondary VGA class GPU is present. The issue arises from improper checks on device types before executing sysfb_disable(), which can lead to critical failures in the system.
How To Fix
Minimum fixed version
6.10.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate risks.
Conclusion
The vulnerability identified in the Linux kernel's sysfb_disable() function poses a significant risk to systems using non-VGA class devices as primary displays. Users are strongly advised to update their linux package to version 6.10.9-1 or later to mitigate this issue. Regular monitoring with tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a NULL pointer dereference in the Linux kernel's sysfb_disable() function, which can lead to system crashes.
The vulnerability affects all versions prior to 6.10.9-1 in Debian 13 and 14.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to avoid potential system instability.
Detailed information can be found in the Debian CVE database or by checking the official Debian security advisories.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
