Critical Vulnerability in Linux Kernel Affecting Debian Packages
Summary
DEBIAN-CVE-2024-46790: In the Linux kernel, the following vulnerability has been resolved: codetag: debug: mark codetags for poisoned page as empty When PG_hwpoison pages are freed they are treated differently in free_pages_prepare() and inste... Affects linux versions < 6.10.11-1. Fixed in 6.10.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware resources and providing essential services to applications. It is known for its stability, performance, and security features. However, vulnerabilities can arise, impacting the overall security and functionality of the system. This specific vulnerability affects Debian versions 13 and 14, highlighting the importance of maintaining an updated and secure kernel.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the handling of PG_hwpoison pages. When these pages are freed, they are incorrectly isolated instead of being released, leading to a decrement in page allocation tag counters. This mismanagement can result in warnings during memory unpoisoning, indicating that the allocation tag was not set. Such issues can lead to system instability and potential exploitation if not addressed promptly.
How To Fix
Minimum fixed version
6.10.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the Linux kernel as described above.
Conclusion
The identified vulnerability in the Linux kernel poses significant risks to Debian users. It is crucial to update to the patched version to ensure system stability and security. Regular monitoring and updating of open-source components are essential practices for maintaining a secure environment.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper handling of PG_hwpoison pages in the Linux kernel, leading to potential system instability.
Debian versions 13 and 14 are affected by this vulnerability.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software without needing to access the code. Visit Vulert Scanner to check your application.
Failure to address this vulnerability may lead to system warnings, instability, and potential exploitation by malicious actors.
The most effective mitigation is to update to the patched version as soon as possible, as no specific workarounds are provided.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
