Critical Vulnerability in Linux Package: ARM Floating Point Instruction Crash
Summary
DEBIAN-CVE-2024-47716: In the Linux kernel, the following vulnerability has been resolved: ARM: 9410/1: vfp: Use asm volatile in fmrx/fmxr macros Floating point instructions in userspace can crash some arm kernels built with clang/LLD 17.0.6:... Affects linux versions < 6.11.2-1. Fixed in 6.11.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, responsible for managing system resources and providing essential services for hardware and software interactions. This package is widely used across various environments, including servers, desktops, and embedded systems. The vulnerability in question affects ARM architectures, particularly those built with specific compiler settings, leading to potential system crashes when executing floating point instructions in user space.
Vulnerability Detail
The vulnerability arises from improper handling of floating point instructions in the Linux kernel, specifically in ARM architectures. When certain conditions are met, such as the kernel being built with clang/LLD 17.0.6 and DYNAMIC_DEBUG set to 'n', executing these instructions can lead to a kernel panic, causing the system to crash. The issue is characterized by an unsupported floating point instruction error, which can be triggered by minimal user space code, leading to severe ramifications for system stability and reliability.
How To Fix
Minimum fixed version
6.11.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid executing floating point instructions in user space or ensure that the kernel is built with DYNAMIC_DEBUG set to 'y'. This can prevent the triggering of the vulnerability until a proper update can be applied.
Conclusion
The vulnerability identified in the Linux package poses a significant risk to ARM architectures, leading to potential system crashes. Users are strongly advised to update to the patched version 6.11.2-1 to mitigate this risk. Temporary workarounds can be employed, but a permanent fix through updating is the best course of action.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves a crash in the Linux kernel on ARM architectures due to unsupported floating point instructions when certain compiler settings are used.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failure to address this vulnerability may lead to system crashes and instability, particularly in environments that rely on ARM architectures.
Yes, the vulnerability is fixed in version 6.11.2-1 of the Linux package.
If immediate updates are not possible, consider applying the workaround by avoiding floating point instructions in user space or ensuring your kernel is built with DYNAMIC_DEBUG set to 'y'.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
