Kernel Crash Vulnerability in Linux Package: nvme-fabrics Race Condition
Summary
DEBIAN-CVE-2024-53169: In the Linux kernel, the following vulnerability has been resolved: nvme-fabrics: fix kernel crash while shutting down controller The nvme keep-alive operation, which executes at a periodic interval, could potentially sn... Affects linux versions < 6.12.3-1. Fixed in 6.12.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system, responsible for managing hardware resources and providing essential services to software applications. It supports various functionalities, including process management, memory management, and device control. The nvme-fabrics feature allows for efficient communication with NVMe devices over networks. However, a race condition vulnerability has been identified, which could lead to kernel crashes during the shutdown of fabric controllers.
Vulnerability Detail
In the Linux kernel, a race condition exists between the fabric controller admin queue destruction and the nvme keep-alive operation. When shutting down a fabric controller, the nvme keep-alive request may interfere with the destruction of the admin queue, leading to a potential kernel crash. This issue arises from changes made in commit a54a93d0e359, which moved the stopping of the keep-alive operation to a later point in the shutdown process, allowing it to sneak in and access already deleted resources.
How To Fix
Minimum fixed version
6.12.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The identified vulnerability in the Linux kernel poses a significant risk due to a race condition that can lead to kernel crashes. It is crucial to update to the patched version 6.12.3-1 or later to mitigate this risk. Regular monitoring and timely updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a race condition in the Linux kernel's nvme-fabrics feature that can lead to kernel crashes during the shutdown of fabric controllers.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
Failure to address this vulnerability may result in unexpected kernel crashes, leading to system instability and potential data loss.
Yes, the vulnerability is fixed in version 6.12.3-1 and later of the Linux package.
Regularly update your packages, monitor for vulnerabilities using tools like Vulert, and apply patches as soon as they are released.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
