Kernel Panic Vulnerability in Linux Package: Critical Fix Required
Summary
DEBIAN-CVE-2024-50034: In the Linux kernel, the following vulnerability has been resolved: net/smc: fix lacks of icsk_syn_mss with IPPROTO_SMC Eric report a panic on IPPROTO_SMC, and give the facts that when INET_PROTOSW_ICSK was set, icsk->ic... Affects linux versions < 6.11.4-1. Fixed in 6.11.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It serves as the foundation for running applications and services on the system. This vulnerability specifically affects the Linux kernel, which is responsible for handling system calls and managing interactions between hardware and software. The vulnerability arises from a flaw in the net/smc module, which can lead to a kernel panic under certain conditions, potentially causing system instability and downtime.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the net/smc module that can lead to a kernel panic due to a NULL pointer dereference. This issue occurs when the INET_PROTOSW_ICSK is set without properly initializing the icsk_sync_mss, resulting in a crash when the system attempts to access an uninitialized memory address. The vulnerability can be exploited under specific network conditions, leading to a denial of service as the kernel becomes unresponsive. The technical details indicate that the panic is triggered during socket creation and connection processes, particularly with the IPPROTO_SMC protocol.
How To Fix
Minimum fixed version
6.11.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users are advised to avoid using the IPPROTO_SMC protocol until the package is updated to the patched version to mitigate the risk of encountering a kernel panic.
Conclusion
The identified vulnerability in the Linux kernel poses a significant risk of kernel panic, which can disrupt system operations. It is crucial for users to update their Linux packages to the patched version 6.11.4-1 to mitigate this risk. Regular monitoring and updates are essential to maintain system security and stability.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a kernel panic issue in the Linux kernel caused by a NULL pointer dereference in the net/smc module.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Exploitation of this vulnerability can lead to a denial of service, causing the system to become unresponsive and potentially requiring a reboot.
Yes, the patched version of the Linux package is 6.11.4-1. Users should update to this version to resolve the issue.
Detailed information can be found in the vulnerability report from Debian's official sources or by using tools like Vulert to monitor your software for vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
