Critical Vulnerability in Linux Kernel: List Corruption in Slab Management
Summary
DEBIAN-CVE-2024-56566: In the Linux kernel, the following vulnerability has been resolved: mm/slub: Avoid list corruption when removing a slab from the full list Boot with slub_debug=UFPZ. Affects linux versions < 6.12.5-1. Fixed in 6.12.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system. The kernel is designed to be efficient and secure, but vulnerabilities can arise due to complex interactions within its code. This specific vulnerability affects the slab memory allocator, which is crucial for managing memory in an efficient manner. The issue can lead to list corruption, potentially compromising system stability and security.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the slab memory management system. When an object fails during consistency checks, it can lead to improper handling of slab pages, causing them to be incorrectly marked and removed from lists. This can result in a corruption of the internal data structures used by the kernel, leading to crashes or unexpected behavior. The vulnerability is triggered under specific conditions, particularly when using the slub_debug=UFPZ boot parameter, which is intended for debugging purposes. The technical details reveal that the corruption can manifest as a 'list_del corruption' error, indicating that the kernel's internal lists have been compromised.
How To Fix
Minimum fixed version
6.12.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the slub_debug=UFPZ boot parameter, which is known to trigger the vulnerability. This may help mitigate the risk until the kernel can be updated to a secure version.
Conclusion
The identified vulnerability in the Linux kernel poses significant risks to system stability and security due to potential list corruption in slab management. Users are strongly advised to update their kernel to the patched version to mitigate these risks. Temporary workarounds are available, but a permanent solution is to ensure the system is running the latest secure kernel version.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes and instability due to list corruption within the kernel's memory management system.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The vulnerability affects versions prior to 6.12.5-1 in both Debian 13 and Debian 14.
Yes, updating to the patched version of the Linux kernel (6.12.5-1) is the permanent fix for this vulnerability.
If immediate updates are not possible, avoid using the slub_debug=UFPZ boot parameter as a temporary workaround to reduce risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
