Critical Vulnerability in Linux Package: Zen4 Client VMLOAD/VMSAVE Instructions Cause Host Reboots
Summary
DEBIAN-CVE-2024-53114: In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client A number of Zen4 client SoCs advertise the ability to use virtualized VMLOAD/VMSAVE, but usi... Affects linux versions < 6.11.10-1. Fixed in 6.11.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It serves as the foundation for running applications and services on Debian systems. The package is known for its stability and performance, but it can be susceptible to vulnerabilities that may compromise system integrity and reliability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the x86/CPU/AMD architecture, specifically concerning the Zen4 client SoCs. These processors incorrectly advertise the capability to use virtualized VMLOAD/VMSAVE instructions. Utilizing these instructions can lead to unexpected behavior, including random host reboots. This issue arises from a misconfiguration in the processor's capability reporting, which should not allow these instructions to be advertised on Zen4 client systems.
How To Fix
Minimum fixed version
6.11.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability other than applying the patch. It is advisable to monitor system behavior and avoid using the VMLOAD/VMSAVE instructions until the patch is applied.
Conclusion
The identified vulnerability in the Linux package related to Zen4 client SoCs poses a significant risk of random host reboots. It is crucial to update to the patched version 6.11.10-1 to mitigate this risk. Users are encouraged to monitor their systems and utilize tools like Vulert for real-time vulnerability alerts.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves incorrect advertising of VMLOAD/VMSAVE instructions on Zen4 client SoCs, which can lead to random host reboots.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
While there are no specific workarounds, it is recommended to monitor your system closely and avoid using the affected instructions until the patch is applied.
Yes, the vulnerability is critical as it can cause random host reboots, potentially leading to data loss and system instability.
Detailed information can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-53114.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
