Critical Race Condition in Linux Kernel - linux Package Vulnerability
Summary
DEBIAN-CVE-2024-46787: In the Linux kernel, the following vulnerability has been resolved: userfaultfd: fix checks for huge PMDs Patch series "userfaultfd: fix races around pmd_trans_huge() check", v2. Affects linux versions < 6.10.11-1. Fixed in 6.10.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux package is the core of the Debian operating system, providing essential functionalities and services for managing hardware and system resources. It is responsible for facilitating communication between software applications and hardware components. This vulnerability affects both Debian 13 and 14 versions of the linux package, specifically in the userfaultfd implementation, which can lead to severe system instability and potential data corruption.
Vulnerability Detail
In the Linux kernel, a race condition exists in the userfaultfd implementation, particularly in the pmd_trans_huge() checks. This vulnerability can lead to a BUG_ON() condition under certain race scenarios, potentially allowing unauthorized access to memory contents or causing kernel crashes. The issue arises from incorrect handling of page table entries, especially in older kernel versions, where the checks for huge PMDs are insufficient, leading to serious security implications.
How To Fix
Minimum fixed version
6.10.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it becomes available to prevent potential exploitation.
Conclusion
The vulnerability in the linux package poses significant risks to system stability and security. It is essential to update to the patched version to safeguard against potential exploitation. Regular monitoring and updates are crucial for maintaining system integrity.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a race condition in the userfaultfd implementation of the Linux kernel, which can lead to system crashes or unauthorized memory access.
The vulnerability affects linux package versions in Debian 13 and 14, specifically those prior to 6.10.11-1.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected by this vulnerability.
Exploitation of this vulnerability could lead to system instability, crashes, and unauthorized access to sensitive memory contents.
Currently, there are no specific workarounds available. It is crucial to apply the patch as soon as it is available to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
