Memory Corruption Vulnerability in Linux Kernel: Debian Packages Affected
Summary
DEBIAN-CVE-2024-52319: In the Linux kernel, the following vulnerability has been resolved: mm: use aligned address in clear_gigantic_page() In current kernel, hugetlb_no_page() calls folio_zero_user() with the fault address. Affects linux versions < 6.12.8-1. Fixed in 6.12.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware and system resources. It provides essential services for all other software running on the system. The kernel is designed to be robust and secure, but vulnerabilities can arise, potentially compromising system integrity and security. This specific vulnerability affects the Linux kernel in Debian versions 13 and 14, highlighting a critical issue in memory management.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the handling of huge pages. The function hugetlb_no_page() calls folio_zero_user() with a fault address that may not be aligned with the required huge page size. This misalignment can lead to the clear_gigantic_page() function being called with an improperly aligned address, resulting in potential memory corruption or information leaks. The issue arises from the kernel's memory management routines, which are crucial for maintaining system stability and security.
How To Fix
Minimum fixed version
6.12.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the Linux kernel.
Conclusion
The identified vulnerability in the Linux kernel poses significant risks to Debian systems, particularly concerning memory management. Users are strongly advised to update to the patched version to mitigate these risks. Regular monitoring and updates are essential to maintain system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves memory corruption due to misalignment of addresses when handling huge pages in the Linux kernel.
Debian versions 13 and 14 are affected by this vulnerability.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
The vulnerability may lead to memory corruption or information leaks, which can compromise system security and stability.
Yes, a patch is available in the form of the updated Linux kernel version 6.12.8-1.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
