Use-After-Put Vulnerability in Linux Kernel Package: linux (Debian 13 & 14)
Summary
DEBIAN-CVE-2024-55639: In the Linux kernel, the following vulnerability has been resolved: net: renesas: rswitch: avoid use-after-put for a device tree node The device tree node saved in the rswitch_device structure is used at several driver l... Affects linux versions < 6.12.6-1. Fixed in 6.12.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux package in Debian is the core of the operating system, providing essential functionalities and managing hardware resources. It is a critical component that allows software applications to interact with the hardware. The vulnerability in question affects the device tree node management within the kernel, which is crucial for device drivers to function correctly.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the handling of device tree nodes in the rswitch_device structure. The issue arises from the incorrect usage of the of_node_put() function, which leads to a use-after-put scenario. This can potentially result in memory corruption, crashes, or exploitation by malicious actors, as the device node may be accessed after it has been released.
How To Fix
Minimum fixed version
6.12.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the package as described above.
Conclusion
The identified use-after-put vulnerability in the Linux kernel's linux package poses significant risks to system stability and security. It is crucial for users to update to the patched version 6.12.6-1 to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert can enhance security posture.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a use-after-put issue in the Linux kernel related to device tree node management.
Exploitation of this vulnerability could lead to memory corruption, system crashes, or unauthorized access to system resources.
Yes, the vulnerability has been patched in version 6.12.6-1 of the linux package for both Debian 13 and 14.
You can check your system's linux package version and compare it with the patched version. Additionally, you can use Vulert to monitor for vulnerabilities.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in your software using a manifest file. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
