Double Free Vulnerability in Linux Kernel - Debian Packages
Summary
DEBIAN-CVE-2024-50159: In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix the double free in scmi_debugfs_common_setup() Clang static checker(scan-build) throws below warning： | drivers/firmware/arm_sc... Affects linux versions < 6.11.6-1. Fixed in 6.11.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing system resources and hardware interactions. It provides essential services for all other software running on the system. This vulnerability affects the firmware component of the ARM SCMI driver, which is responsible for managing communication between system components. The vulnerability arises from improper memory management, leading to potential system instability and security risks.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the ARM SCMI driver where a double free condition occurs in the function scmi_debugfs_common_setup(). This happens when the function devm_add_action_or_reset() fails, causing scmi_debugfs_common_cleanup() to execute twice, leading to an attempt to free already released memory. This can result in undefined behavior, crashes, or exploitation by attackers to gain unauthorized access or control over the system.
How To Fix
Minimum fixed version
6.11.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate the risk.
Conclusion
The identified double free vulnerability in the Linux kernel's ARM SCMI driver poses significant risks to system stability and security. It is essential to update to the patched version to protect against potential exploitation. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system integrity.
See every vulnerability recorded for linux →
FAQ
A double free vulnerability occurs when a program attempts to free the same memory location more than once, leading to potential memory corruption and security risks.
This vulnerability can lead to system crashes, instability, or exploitation by attackers, potentially allowing them to execute arbitrary code or gain unauthorized access.
If you are using the affected versions of the Linux kernel on Debian 13 or 14, your system may be vulnerable. You can check for vulnerabilities using Vulert's playground without any signup.
Vulert provides a service that monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. You can use it to receive real-time alerts.
While there are no specific workarounds, it is crucial to prioritize updating your system to the patched version as soon as possible to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
