Critical Vulnerability in Linux Package: JH7110 SoC Reset Control Access Issue
Summary
DEBIAN-CVE-2024-50137: In the Linux kernel, the following vulnerability has been resolved: reset: starfive: jh71x0: Fix accessing the empty member on JH7110 SoC data->asserted will be NULL on JH7110 SoC since commit 82327b127d41 ("reset: starf... Affects linux versions < 6.11.6-1. Fixed in 6.11.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system processes. It is widely used across various platforms, including servers, desktops, and embedded systems. The kernel's functionality includes managing system resources, handling input/output operations, and ensuring security. However, vulnerabilities can arise, such as the one affecting the reset control mechanism for the JH7110 System on Chip (SoC), which can lead to system instability or crashes if not addressed.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the reset control mechanism for the StarFive JH7110 SoC. The issue arises from an attempt to access a member of a data structure that can be NULL, specifically 'data->asserted', which leads to potential errors when calling the 'reset_control_status' function. This vulnerability was introduced with the addition of the StarFive JH7110 reset driver and can result in system crashes or undefined behavior if the condition is not properly checked.
How To Fix
Minimum fixed version
6.11.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can avoid using the reset control functionality on the JH7110 SoC until the patch is applied. This may involve disabling specific features that rely on the reset control mechanism to prevent potential crashes.
Conclusion
The vulnerability in the Linux kernel affecting the JH7110 SoC's reset control mechanism poses significant risks to system stability. Users are strongly advised to update to the patched version 6.11.6-1 to ensure their systems remain secure. In the meantime, workarounds can be employed to minimize potential issues.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves accessing a NULL member in the reset control mechanism for the JH7110 SoC, which can lead to system instability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If exploited, this vulnerability can cause system crashes or undefined behavior, impacting the stability and reliability of the system.
Yes, a patch is available in version 6.11.6-1 of the Linux package for both Debian 13 and Debian 14.
If an immediate update is not possible, consider disabling features that rely on the reset control mechanism to mitigate the risk of crashes.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
