Kernel Memory Access Vulnerability in Linux Package - CVE-2024-46792
Summary
DEBIAN-CVE-2024-46792: In the Linux kernel, the following vulnerability has been resolved: riscv: misaligned: Restrict user access to kernel memory raw_copy_{to,from}_user() do not call access_ok(), so this code allowed userspace to access any... Affects linux versions < 6.10.11-1. Fixed in 6.10.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, responsible for managing system resources and providing essential services to applications. It is widely used across various environments, including servers, desktops, and embedded systems. This package is critical for system stability and security, making it imperative to address any vulnerabilities that may arise.
Vulnerability Detail
In the Linux kernel, a vulnerability identified as CVE-2024-46792 has been discovered, which allows userspace applications to access kernel memory due to improper checks in the raw_copy_{to,from}_user() functions. This oversight means that user applications could potentially read or write to any virtual memory address, leading to unauthorized access to sensitive data or system instability. The vulnerability originates from the RISC-V architecture's handling of misaligned memory access, which did not enforce proper access checks.
How To Fix
Minimum fixed version
6.10.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The CVE-2024-46792 vulnerability in the Linux kernel poses significant risks by allowing unauthorized access to kernel memory. Users are strongly advised to update their Linux package to the latest patched version to mitigate these risks effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2024-46792 is a vulnerability in the Linux kernel that allows userspace applications to access kernel memory due to insufficient access checks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The risks include unauthorized access to sensitive data, potential system crashes, and exploitation by malicious applications.
Yes, a patch is available in version 6.10.11-1 of the Linux package. Users should update to this version or later.
While there are no specific workarounds, it is crucial to monitor your system for any unusual activity and apply the patch as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
