Critical Vulnerability in Linux Kernel: Page Fault Risk in TLS Context Handling
Summary
DEBIAN-CVE-2024-53091: In the Linux kernel, the following vulnerability has been resolved: bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx As the introduction of the support for vsock and unix sockets in sockmap, tls_sw_has_ctx_t... Affects linux versions < 6.11.9-1. Fixed in 6.11.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware resources and providing essential services to software applications. It supports various functionalities, including process management, memory management, and device control. This vulnerability affects the Linux kernel versions in Debian 13 and 14, specifically within the TLS (Transport Layer Security) context handling in socket communications. The vulnerability arises from the improper handling of socket types, which can lead to system instability and crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the handling of TLS contexts in the function tls_sw_ctx_rx. The issue stems from the introduction of vsock and unix sockets in sockmap, which do not conform to the expected socket type (IS_ICSK). This can cause the function tls_get_ctx to return an invalid pointer, leading to a page fault when the system attempts to access memory at that address. The specific error is a BUG: unable to handle page fault for address: 0000000000040030, which can result in a system crash and potential data loss.
How To Fix
Minimum fixed version
6.11.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected socket types (vsock and af_unix) in their applications until the kernel is updated. However, this is not a permanent solution and updating the kernel is strongly recommended.
Conclusion
The identified vulnerability in the Linux kernel poses a significant risk to systems running Debian 13 and 14. It is crucial for users to update their kernel to the patched version 6.11.9-1 to prevent potential crashes and data loss. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes and data loss due to page faults caused by invalid memory access.
The vulnerability affects the Linux kernel versions in Debian 13 and 14 prior to the fixed version 6.11.9-1.
You can use Vulert, which monitors open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without any signup.
As a temporary measure, avoid using vsock and af_unix socket types in your applications until you can apply the kernel update.
More details can be found in the official Debian CVE database or by visiting the Vulert website for real-time monitoring of vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
