Critical Allocation Vulnerability in Linux Kernel Package: linux - ntfs3 Non-blocking Allocation Issue
Summary
DEBIAN-CVE-2024-50065: In the Linux kernel, the following vulnerability has been resolved: ntfs3: Change to non-blocking allocation in ntfs_d_hash d_hash is done while under "rcu-walk" and should not sleep. Affects linux versions < 6.11.4-1. Fixed in 6.11.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'linux' package is a core component of the Debian operating system, providing the Linux kernel that manages hardware resources and enables the execution of applications. It is crucial for system stability and performance. The kernel supports various filesystems, including NTFS, and is responsible for managing memory allocation. This vulnerability affects the ntfs3 filesystem driver, which is responsible for handling NTFS file systems in Linux.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the ntfs3 filesystem driver related to memory allocation. Specifically, the function ntfs_d_hash performs a blocking allocation using GFP_KERNEL while under 'rcu-walk', which should not sleep. This can lead to potential deadlocks or performance degradation under memory pressure, as the allocation may fail when the system is low on memory. The issue arises from the improper use of memory allocation flags, which can compromise system stability.
How To Fix
Minimum fixed version
6.11.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch by updating the package as mentioned in the 'how_to_fix' section.
Conclusion
The identified vulnerability in the linux package's ntfs3 filesystem driver poses a significant risk to system stability due to improper memory allocation. Users are strongly encouraged to update to the patched version 6.11.4-1 to mitigate this risk. Regular monitoring and timely updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves a blocking memory allocation in the ntfs3 filesystem driver, which can lead to potential deadlocks under memory pressure.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Failure to address this vulnerability may result in system instability, performance issues, or even crashes during memory-intensive operations.
Yes, the vulnerability is fixed in version 6.11.4-1 of the linux package. It is crucial to update to this version or later.
While there are no specific workarounds, it is advisable to monitor system performance and avoid memory-intensive operations until the package can be updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
