Critical NULL Pointer Dereference in Linux Kernel: linux Package Vulnerability
Summary
DEBIAN-CVE-2024-46799: In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw: Fix NULL dereference on XDP_TX If number of TX queues are set to 1 we get a NULL pointer dereference during XDP_TX. Affects linux versions < 6.10.11-1. Fixed in 6.10.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux package is a core component of the Debian operating system, providing the essential kernel that manages system resources and hardware interactions. It is responsible for enabling the execution of applications and managing system processes. This package is crucial for system stability and performance, and vulnerabilities within it can lead to severe security risks and system failures.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2024-46799 arises from a NULL pointer dereference in the Linux kernel's ethernet subsystem, specifically in the am65-cpsw driver. When the number of TX (transmit) queues is set to 1, a NULL pointer dereference occurs during the XDP_TX operation, potentially leading to system crashes or unpredictable behavior. This issue can be exploited by malicious actors to disrupt network operations or cause denial of service.
How To Fix
Minimum fixed version
6.10.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid setting the number of TX queues to 1. Instead, configure the TX queues to a higher number to prevent the NULL pointer dereference from occurring during XDP_TX operations.
Conclusion
The DEBIAN-CVE-2024-46799 vulnerability in the linux package poses a significant risk due to a NULL pointer dereference in the kernel. Users are advised to update to the patched version 6.10.11-1 to mitigate this risk. Implementing workarounds and maintaining regular updates are crucial for system security.
See every vulnerability recorded for linux →
FAQ
A NULL pointer dereference occurs when a program attempts to access memory at a location that has not been initialized, leading to crashes or undefined behavior.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without any signup.
Exploitation of this vulnerability can lead to system crashes, denial of service, and potential unauthorized access to system resources.
While the primary risk is system instability, in some cases, it may lead to data loss if the system crashes during critical operations.
It is recommended to regularly check for updates and apply them promptly to ensure your system is protected against known vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
