Kernel Vulnerability in Linux Package: Fix for ivpu IPC Runtime State Issue
Summary
DEBIAN-CVE-2024-54193: In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix WARN in ivpu_ipc_send_receive_internal() Move pm_runtime_set_active() to ivpu_pm_init() so when ivpu_ipc_send_receive_internal() is exec... Affects linux versions < 6.12.8-1. Fixed in 6.12.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware and system resources. It provides essential services for all other parts of the system, including process management, memory management, and device control. The kernel is crucial for system stability and performance. This vulnerability affects the Linux kernel versions in Debian 13 and 14, specifically related to the ivpu IPC (Inter-Process Communication) functionality, which is responsible for communication between different processes in the system.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified in the accel/ivpu module, which could lead to incorrect runtime state management during IPC operations. The issue arises when the function ivpu_ipc_send_receive_internal() is executed before the ivpu_pm_enable() function, resulting in a warning due to an improper runtime state. This could potentially lead to system instability or unexpected behavior if not addressed, as it may affect the performance and reliability of IPC communications.
How To Fix
Minimum fixed version
6.12.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch by updating the Linux package as mentioned above.
Conclusion
The identified vulnerability in the Linux kernel's ivpu IPC functionality poses a risk of system instability due to improper runtime state management. Users are advised to update to the patched version 6.12.8-1 or later to ensure system integrity and performance. Monitoring tools like Vulert can assist in identifying such vulnerabilities in open-source software.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper runtime state management in the ivpu IPC functionality of the Linux kernel, which can lead to warnings and potential system instability.
The affected versions are those prior to 6.12.8-1 in both Debian 13 and 14.
You can check your system's Linux version using the command 'uname -r' in the terminal. If it is below 6.12.8-1, it is affected.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check your application for vulnerabilities using the Vulert playground without any signup.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risks associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
