Critical Vulnerability in Linux Kernel: NULL Argument Passed to vma_iter_prealloc()
Summary
DEBIAN-CVE-2024-53109: In the Linux kernel, the following vulnerability has been resolved: nommu: pass NULL argument to vma_iter_prealloc() When deleting a vma entry from a maple tree, it has to pass NULL to vma_iter_prealloc() in order to cal... Affects linux versions < 6.11.10-1. Fixed in 6.11.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system resources. It is known for its stability, performance, and flexibility, making it a popular choice for servers, desktops, and embedded systems. However, vulnerabilities can arise, impacting system reliability and security. This specific vulnerability affects the nommu (non-memory management unit) kernels, which are designed for systems without a memory management unit, making them particularly sensitive to such issues.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified where a NULL argument was incorrectly passed to the vma_iter_prealloc() function when deleting a vma entry from a maple tree. This error caused nommu kernels to crash when accessing a vma iterator, particularly during operations like acct_collect() that read the size of vma entries after do_munmap(). The incorrect argument led to instability and potential system crashes, posing a significant risk to systems relying on nommu kernels.
How To Fix
Minimum fixed version
6.11.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds have been provided for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the Linux kernel as mentioned above.
Conclusion
The identified vulnerability in the Linux kernel poses a significant risk to systems utilizing nommu kernels, leading to potential crashes and instability. It is imperative for users to update their systems to the patched version to ensure continued reliability and security. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes in nommu kernels, affecting stability and potentially causing data loss.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
The vulnerability affects Linux versions prior to 6.11.10-1 in both Debian 13 and Debian 14.
Yes, updating to the patched version of the Linux kernel (6.11.10-1) resolves the vulnerability.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risks associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
