Out-of-Bounds Read Vulnerability in Linux Kernel Package: linux
Summary
DEBIAN-CVE-2024-47721: In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: remove unused C2H event ID RTW89_MAC_C2H_FUNC_READ_WOW_CAM to prevent out-of-bounds reading The handler of firmware C2H event RTW89_MAC_C2H... Affects linux versions < 6.11.2-1. Fixed in 6.11.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It is widely used across various platforms, including servers, desktops, and embedded systems. The linux package in Debian distributions is crucial for system stability and performance. However, it is susceptible to vulnerabilities that can compromise system security and functionality.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the handling of firmware C2H events, specifically the RTW89_MAC_C2H_FUNC_READ_WOW_CAM event. The handler for this event is not implemented, yet the driver expects a specific number of handlers, leading to an out-of-bounds access. This flaw can potentially allow an attacker to exploit the system, causing unexpected behavior or crashes. The vulnerability is addressed by removing the unused event ID, which prevents the out-of-bounds reading.
How To Fix
Minimum fixed version
6.11.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the package as described above.
Conclusion
The identified out-of-bounds read vulnerability in the Linux kernel's handling of firmware events poses a significant risk to system integrity. It is crucial for users of the linux package in Debian distributions to update to the patched version 6.11.2-1 to mitigate this risk. Regular monitoring for vulnerabilities is essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability is an out-of-bounds read issue in the Linux kernel related to firmware C2H event handling.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Exploitation of this vulnerability could lead to system crashes or unexpected behavior, compromising system stability and security.
Yes, the vulnerability is fixed in version 6.11.2-1 of the linux package for both Debian 13 and 14.
It is recommended to regularly check for vulnerabilities and updates to ensure your system remains secure. Tools like Vulert can help automate this process.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
