Critical Overflow Vulnerability in Linux Kernel - Debian Packages
Summary
DEBIAN-CVE-2024-47719: In the Linux kernel, the following vulnerability has been resolved: iommufd: Protect against overflow of ALIGN() during iova allocation Userspace can supply an iova and uptr such that the target iova alignment becomes re... Affects linux versions < 6.11.2-1. Fixed in 6.11.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware resources and providing essential services to applications. It is known for its stability, performance, and security features. However, it is also susceptible to vulnerabilities that can affect system integrity and security. This specific vulnerability relates to the iommufd subsystem, which manages I/O memory management for devices.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the iommufd subsystem that allows userspace to supply an I/O virtual address (IOVA) and an uptr, potentially causing an overflow during alignment calculations. This overflow can corrupt the selected area range during allocation, leading to unpredictable behavior, system crashes, or security breaches. The issue arises from improper handling of alignment calculations, which can lead to excessive fragmentation of the IOVA space.
How To Fix
Minimum fixed version
6.11.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the automatic alignment to the huge page size to prevent excessive fragmentation of the IOVA space. This can be done by modifying the kernel parameters related to IOMMU settings, although this may not fully mitigate the risk until the patch is applied.
Conclusion
The identified vulnerability in the Linux kernel's iommufd subsystem poses significant risks to system stability and security. Users are strongly advised to update their kernel to the patched version 6.11.2-1 to mitigate these risks. Temporary workarounds can be applied, but they do not replace the need for a proper update.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes, unpredictable behavior, and potential security breaches due to memory corruption.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Yes, the patched version of the Linux kernel is 6.11.2-1 for both Debian 13 and 14.
Consider applying the temporary workaround by limiting the automatic alignment to the huge page size until you can update.
Detailed information can be found in the Debian CVE database and through security advisories related to the Linux kernel.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
