HID Driver Probe Issue in Linux Kernel: CVE-2024-56545
Summary
DEBIAN-CVE-2024-56545: In the Linux kernel, the following vulnerability has been resolved: HID: hyperv: streamline driver probe to avoid devres issues It was found that unloading 'hid_hyperv' module results in a devres complaint: ... Affects linux versions < 6.12.3-1. Fixed in 6.12.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware and system resources. It provides essential services for all other parts of the operating system and is critical for system stability and performance. The vulnerability in question affects the HID (Human Interface Device) subsystem, specifically the Hyper-V HID driver, which is responsible for handling input devices in virtualized environments. This vulnerability can lead to resource management issues when unloading the driver, potentially causing system instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the HID subsystem related to the Hyper-V HID driver. When the 'hid_hyperv' module is unloaded, it triggers a devres complaint due to the absence of a corresponding devres group allocation. The issue arises because the driver overrides the default handling of device resources, leading to improper resource management. This can result in warnings and potential crashes, affecting system reliability and performance. The root cause is linked to the implementation of the driver that bypasses necessary resource allocation calls, leading to unhandled resource releases.
How To Fix
Minimum fixed version
6.12.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it becomes available to ensure system stability.
Conclusion
The vulnerability CVE-2024-56545 in the Linux kernel's HID subsystem poses a risk to system stability when unloading the Hyper-V HID driver. It is essential to apply the available patch to mitigate this issue and ensure the reliability of your system.
See every vulnerability recorded for linux →
FAQ
CVE-2024-56545 is a vulnerability in the Linux kernel's HID subsystem that affects the Hyper-V HID driver, leading to potential resource management issues.
This vulnerability can cause warnings and potentially lead to system crashes when unloading the affected driver, impacting overall system stability.
Yes, a patch is available in version 6.12.3-1 of the Linux package. It is recommended to update to this version or later.
While there are no specific workarounds, it is crucial to monitor your system for any unusual behavior and plan to apply the patch as soon as possible.
You can use Vulert, which allows you to monitor and alert in real-time for open-source vulnerabilities. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
