Critical Vulnerability in Linux Kernel: Resource Flag Discarding During Kexec
Summary
DEBIAN-CVE-2024-50303: In the Linux kernel, the following vulnerability has been resolved: resource,kexec: walk_system_ram_res_rev must retain resource flags walk_system_ram_res_rev() erroneously discards resource flags when passing the inform... Affects linux versions < 6.11.7-1. Fixed in 6.11.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It manages system resources, memory, and processes, ensuring efficient operation. The kernel is crucial for system stability and performance. This vulnerability affects versions of the Linux kernel in Debian 13 and 14, specifically related to the handling of resource flags during the kexec process, which can lead to undefined behavior and system crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified where the function walk_system_ram_res_rev incorrectly discards resource flags when passing information to a callback. This issue arises when systems with IORESOURCE_SYSRAM_DRIVER_MANAGED memory are selected during kexec to store kexec buffers, particularly if that memory is positioned above normal system RAM. The consequence of this flaw is undefined behavior after a reboot, which could lead to system crashes if the kexec buffer is accessed. The vulnerability has been tested on systems with CXL memory expanders and TPM enabled, revealing critical issues in memory management and error handling.
How To Fix
Minimum fixed version
6.11.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, avoiding the use of kexec in systems that utilize IORESOURCE_SYSRAM_DRIVER_MANAGED memory may mitigate potential risks until the patch is applied.
Conclusion
The identified vulnerability in the Linux kernel poses significant risks to system stability and performance, particularly in environments utilizing specific memory configurations. It is crucial for users to update to the patched version to safeguard against potential crashes and undefined behavior. Utilizing tools like Vulert can aid in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves the incorrect handling of resource flags in the Linux kernel, which can lead to undefined behavior and system crashes during the kexec process.
The affected versions are those in Debian 13 and 14 prior to the patch version 6.11.7-1.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected without needing to install any software.
Failure to address this vulnerability may result in system crashes and undefined behavior, especially when using kexec with specific memory configurations.
While there are no specific workarounds available, avoiding the use of kexec in affected systems may reduce the risk until the patch is applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
