Critical Vulnerability in Linux Kernel: NULL Pointer Dereference in unpin_user_pages()
Summary
DEBIAN-CVE-2024-56612: In the Linux kernel, the following vulnerability has been resolved: mm/gup: handle NULL pages in unpin_user_pages() The recent addition of "pofs" (pages or folios) handling to gup has a flaw: it assumes that unpin_user_p... Affects linux versions < 6.12.5-1. Fixed in 6.12.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system. The kernel is continuously updated to enhance performance, security, and stability. However, vulnerabilities can arise, such as the one identified in this report, which affects versions of the Linux kernel in Debian 13 and 14.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the handling of NULL pages within the unpin_user_pages() function. This flaw arises from an incorrect assumption that unpin_user_pages() can manage NULL pages in the pages array. When this function encounters a NULL page, it leads to a kernel NULL pointer dereference, causing system crashes. This issue was discovered during testing on a specific configuration, highlighting the potential for significant system instability and crashes when running affected kernel versions.
How To Fix
Minimum fixed version
6.12.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the kernel as described above.
Conclusion
The identified vulnerability in the Linux kernel poses a significant risk of system crashes due to NULL pointer dereference in the unpin_user_pages() function. Users are strongly advised to update their kernel to the patched version 6.12.5-1 or later to ensure system stability and security.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a NULL pointer dereference in the unpin_user_pages() function of the Linux kernel, which can lead to system crashes.
The vulnerability affects the Linux kernel versions in Debian 13 and 14 prior to the patch version 6.12.5-1.
You can check if your system is affected by using tools like Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
If exploited, this vulnerability can lead to system crashes and instability, potentially affecting critical operations and services running on the affected systems.
The most effective mitigation is to update to the patched version of the kernel. There are no specific workarounds available at this time.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
