Kernel Panic Vulnerability in Linux Package: BPF LSM Return Value Check
Summary
DEBIAN-CVE-2024-47703: In the Linux kernel, the following vulnerability has been resolved: bpf, lsm: Add check for BPF LSM return value A bpf prog returning a positive number attached to file_alloc_security hook makes kernel panic. Affects linux versions < 6.11.2-1. Fixed in 6.11.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It is widely used in various distributions, including Debian. The kernel's functionality is critical for system stability and performance. This vulnerability specifically affects the Linux kernel versions in Debian 13 and 14, which utilize the BPF (Berkeley Packet Filter) for security management.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the BPF LSM (Linux Security Module) return value. When a BPF program returns a positive number attached to the file_alloc_security hook, it can lead to a kernel panic. This occurs because the file system cannot properly filter out the positive number using IS_ERR, misinterpreting it as a file pointer. This issue arises from the fact that the file_alloc_security hook never returned a positive number prior to the introduction of BPF LSM, and similar issues may arise in other BPF LSM hooks. The vulnerability could lead to system crashes and instability, affecting the overall security and reliability of the system.
How To Fix
Minimum fixed version
6.11.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The identified vulnerability in the Linux kernel related to BPF LSM return values poses a significant risk of kernel panic and system instability. It is crucial for users of Debian 13 and 14 to update their Linux packages to the fixed version 6.11.2-1 to mitigate this risk. Regular monitoring and prompt updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
This vulnerability can lead to kernel panic, causing system crashes and instability.
The vulnerability affects Linux kernel versions in Debian 13 and 14 prior to the fixed version 6.11.2-1.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
Yes, the patched version is 6.11.2-1 for both Debian 13 and 14.
While there are no specific workarounds, it is advisable to monitor your system closely and apply the patch as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
