Critical Vulnerability in Linux Package: Endpoint Controller Cleanup Issue
Summary
DEBIAN-CVE-2024-53152: In the Linux kernel, the following vulnerability has been resolved: PCI: tegra194: Move controller cleanups to pex_ep_event_pex_rst_deassert() Currently, the endpoint cleanup function dw_pcie_ep_cleanup() and EPF deinit... Affects linux versions < 6.12.3-1. Fixed in 6.12.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It serves as the foundation for various applications and services, ensuring efficient communication between software and hardware. This vulnerability affects the Tegra194 endpoint SoCs, which rely on host-provided reference clock (refclk) for operational stability. The issue arises during the cleanup process of the endpoint controller, potentially leading to system crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the cleanup functions of the Tegra194 endpoint controller. Specifically, the cleanup functions are executed during the assertion of the PERST# signal, which disables the refclk from the host. This results in attempts to access hardware registers without an active refclk, causing crashes in the endpoint SoC. The vulnerability stems from the timing of cleanup operations, which must occur when the refclk is guaranteed to be active to prevent system instability.
How To Fix
Minimum fixed version
6.12.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. However, it is advisable to monitor the system for any unusual behavior and apply the patch as soon as it becomes available.
Conclusion
The identified vulnerability in the Linux package poses significant risks to systems utilizing Tegra194 endpoint SoCs. It is crucial for users to update to the patched version 6.12.3-1 to ensure system stability and security. Monitoring tools like Vulert can assist in identifying vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper cleanup of the endpoint controller during the assertion of the PERST# signal, leading to potential system crashes.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By utilizing the manifest file like package-lock.json, Vulert can help identify if your application is affected.
Yes, a patch has been released in version 6.12.3-1 of the Linux package. Users should update to this version to mitigate the vulnerability.
Failure to address this vulnerability may result in system crashes and instability, particularly for systems utilizing Tegra194 endpoint SoCs.
Detailed information can be found in the Debian CVE database or by visiting Vulert's playground at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
