Critical Vulnerability in Linux Kernel: hwmon WMI Event Data Handling
Summary
DEBIAN-CVE-2024-46768: In the Linux kernel, the following vulnerability has been resolved: hwmon: (hp-wmi-sensors) Check if WMI event data exists The BIOS can choose to return no event data in response to a WMI event, so the ACPI object passed... Affects linux versions < 6.10.11-1. Fixed in 6.10.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It supports a wide range of hardware architectures and is known for its stability and performance. However, vulnerabilities can arise, such as the one identified in the hwmon subsystem, which deals with hardware monitoring. This specific vulnerability relates to the handling of WMI (Windows Management Instrumentation) events, which can lead to potential system instability if not addressed.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the hwmon subsystem, specifically related to the hp-wmi-sensors. The issue arises when the BIOS returns no event data in response to a WMI event, resulting in a NULL ACPI object being passed to the WMI notify handler. This oversight can lead to undefined behavior or crashes, as the system does not appropriately handle the absence of event data. The vulnerability has been assigned the identifier DEBIAN-CVE-2024-46768 and affects Debian versions 13 and 14.
How To Fix
Minimum fixed version
6.10.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate any risks associated with this issue.
Conclusion
The vulnerability identified in the Linux kernel's hwmon subsystem poses a significant risk due to improper handling of WMI event data. Users are strongly advised to update their systems to the patched version 6.10.11-1 to mitigate potential issues. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper handling of WMI event data in the hwmon subsystem of the Linux kernel, which can lead to system instability.
The vulnerability affects Debian versions 13 and 14 of the Linux kernel.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
While there are no specific workarounds, it is crucial to plan for an update to the patched version as soon as possible to avoid potential risks.
Detailed information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-46768.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
