Kernel Vulnerability in Linux Package: Memory Management Issue During Module Unload
Summary
DEBIAN-CVE-2024-50212: In the Linux kernel, the following vulnerability has been resolved: lib: alloc_tag_module_unload must wait for pending kfree_rcu calls Ben Greear reports following splat: ------------[ cut here ]------------ net/netfilte... Affects linux versions < 6.11.7-1. Fixed in 6.11.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system, responsible for managing hardware resources and providing essential services to applications. It supports a wide range of functionalities, including process management, memory management, and device control. This vulnerability affects the Linux kernel versions in Debian 13 and 14, specifically related to the handling of memory during the unloading of kernel modules, which can lead to warnings and potential instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the memory management system, specifically in the function alloc_tag_module_unload. This issue arises when the nf_nat module is unloaded while there are outstanding kfree_rcu calls. The improper handling of these calls can lead to warnings during module unloading, indicating that memory allocations are still pending. This could potentially result in system instability or unexpected behavior, particularly in network-related functionalities.
How To Fix
Minimum fixed version
6.11.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid unloading the nf_nat module while there are outstanding kfree_rcu calls. This can be done by ensuring that all network operations using this module are completed before attempting to unload it.
Conclusion
The identified vulnerability in the Linux kernel related to memory management during module unloading poses risks of system instability. Users are advised to update their Linux packages to the latest patched version to mitigate these risks. Additionally, temporary workarounds can help manage the situation until the update is applied.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper memory management during the unloading of kernel modules, specifically related to the nf_nat module.
The vulnerability affects Linux kernel versions in Debian 13 and 14 prior to version 6.11.7-1.
The main consequence is the generation of warnings during module unloading, which could lead to system instability or unexpected behavior.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, updating the Linux package to version 6.11.7-1 or later will permanently fix the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
