Deadlock Risk in Linux Kernel's stack_depot_save_flags Function - Linux Package Vulnerability
Summary
DEBIAN-CVE-2024-48876: In the Linux kernel, the following vulnerability has been resolved: stackdepot: fix stack_depot_save_flags() in NMI context Per documentation, stack_depot_save_flags() was meant to be usable from NMI context if STACK_DEP... Affects linux versions < 6.12.5-1. Fixed in 6.12.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It serves as the foundation for various applications and services, ensuring efficient operation and performance. However, vulnerabilities in the Linux kernel can lead to significant security risks, affecting system stability and data integrity.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified in the stack_depot_save_flags() function, which is intended to be used in Non-Maskable Interrupt (NMI) context when the STACK_DEPOT_FLAG_CAN_ALLOC is unset. The function attempts to acquire a lock (pool_lock) to save a stack trace, which can lead to a deadlock if an NMI occurs while the lock is already held. This situation poses a risk of system instability and can hinder the kernel's ability to handle critical interrupts effectively.
How To Fix
Minimum fixed version
6.12.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. Users are advised to apply the patch as soon as it is available to mitigate the risk.
Conclusion
The vulnerability identified in the Linux kernel's stack_depot_save_flags() function poses a significant risk of deadlock in NMI context. Users are strongly encouraged to update to the patched version 6.12.5-1 to mitigate this risk and maintain system stability. Utilizing tools like Vulert can further enhance security by monitoring for vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves a potential deadlock scenario in the stack_depot_save_flags() function of the Linux kernel when used in NMI context.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability could lead to system deadlocks, affecting the kernel's ability to manage interrupts and potentially causing system crashes.
Yes, a patch is available in version 6.12.5-1 of the Linux package. Users should update to this version or later.
Vulert is a tool that monitors and alerts users in real-time for open-source vulnerabilities in software using a manifest file like package-lock.json. It helps ensure your applications are secure.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
