Potential Use After Free Vulnerability in Linux Kernel - Debian Packages
Summary
DEBIAN-CVE-2024-47732: In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - Fix potential use after free bug The free_device_compression_mode(iaa_device, device_mode) function frees "device_mode" but it iss passed... Affects linux versions < 6.11.2-1. Fixed in 6.11.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing system resources and facilitating communication between hardware and software. It is a critical element that ensures the stability and performance of the system. The recent vulnerability identified as DEBIAN-CVE-2024-47732 affects the crypto subsystem, specifically related to the handling of device compression modes, which could potentially lead to security risks if not addressed.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the crypto subsystem where the function free_device_compression_mode(iaa_device, device_mode) frees the 'device_mode' variable but subsequently passes it to iaa_compression_modes[i]->free() shortly after. This creates a potential use after free scenario. Although currently, no implementations of the ->free() function exist, and the use after free occurs in dead code, it poses a risk for future implementations. If left unpatched, it could lead to undefined behavior or security breaches when the code is executed.
How To Fix
Minimum fixed version
6.11.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate any potential risks.
Conclusion
The vulnerability DEBIAN-CVE-2024-47732 in the Linux kernel presents a potential use after free issue that could have serious implications if not addressed. Users are strongly encouraged to update their systems to the patched version to ensure security and stability. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a potential use after free issue in the Linux kernel's crypto subsystem, which could lead to undefined behavior if exploited.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If exploited, this vulnerability could lead to security breaches, allowing attackers to execute arbitrary code or crash the system.
Yes, a patch has been released in version 6.11.2-1 for both Debian 13 and 14. Users are advised to update their packages.
While there are no specific workarounds, it is crucial to prioritize updating your system to mitigate risks associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
