Critical Vulnerability in Linux Kernel: Shutdown Sequence Issues in DSA Drivers
Summary
DEBIAN-CVE-2024-49998: In the Linux kernel, the following vulnerability has been resolved: net: dsa: improve shutdown sequence Alexander Sverdlin presents 2 problems during shutdown with the lan9303 driver. Affects linux versions < 6.11.4-1. Fixed in 6.11.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system and is known for its robustness and flexibility. However, vulnerabilities can arise, particularly in complex subsystems like the Distributed Switch Architecture (DSA), which manages network devices. This specific vulnerability affects the shutdown sequence of DSA drivers, particularly the lan9303 driver, leading to potential security risks during device shutdown.
Vulnerability Detail
The vulnerability arises from two main issues during the shutdown of the lan9303 driver. First, the driver calls dev_get_drvdata() at arbitrary times, which can lead to a null pointer dereference (NPD) if the driver is not properly stopped. Second, there is a race condition where the driver may dereference a pointer without proper locking, risking data corruption or crashes. Both issues stem from improper handling of the shutdown sequence, which can leave the system vulnerable to unexpected behavior or exploitation.
How To Fix
Minimum fixed version
6.11.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually close the conduit interface by using the command 'dev_close(conduit)' before shutting down the system. This will help mitigate the issues related to the race condition and ensure that the driver does not continue to operate unexpectedly during shutdown.
Conclusion
The vulnerability in the Linux kernel's DSA drivers presents significant risks during the shutdown sequence, particularly for the lan9303 driver. Users are advised to update to the patched version to mitigate these risks. Implementing the provided workaround can also help reduce potential issues until an update can be applied.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system instability, crashes, or potential exploitation if an attacker can manipulate the shutdown sequence of the affected driver.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
Yes, if the vulnerability is exploited, it could lead to data corruption or loss during the shutdown process.
If an immediate update is not possible, implement the workaround by closing the conduit interface before shutdown to reduce risk.
This specific vulnerability affects Debian-based distributions that utilize the affected versions of the Linux kernel. Other distributions may not be impacted unless they use the same kernel version.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
