Critical NULL Pointer Dereference in Linux Kernel - Debian Package
Summary
DEBIAN-CVE-2024-56620: In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: qcom: Only free platform MSIs when ESI is enabled Otherwise, it will result in a NULL pointer dereference as below: Unable to handle kernel N... Affects linux versions < 6.12.5-1. Fixed in 6.12.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware and system resources. It provides essential services for all other software running on the system. This vulnerability affects the Linux kernel versions in Debian 13 and 14, specifically related to the SCSI UFS driver for Qualcomm devices, which can lead to system instability and crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the SCSI UFS driver for Qualcomm platforms. The issue arises when platform MSIs (Message Signaled Interrupts) are not freed correctly when ESI (Enhanced Serial Interface) is enabled. This oversight can lead to a NULL pointer dereference, causing the kernel to crash and resulting in a system failure. The vulnerability is critical as it can be exploited to disrupt system operations and potentially lead to data loss.
How To Fix
Minimum fixed version
6.12.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate risks.
Conclusion
The identified vulnerability in the Linux kernel poses significant risks to system stability and security. It is essential for users of Debian 13 and 14 to update their kernel to the fixed version 6.12.5-1 to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system integrity.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to a NULL pointer dereference, causing the kernel to crash and potentially resulting in system instability and data loss.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
Yes, a patch is available in the form of the Linux kernel version 6.12.5-1 for both Debian 13 and 14.
While there are no specific workarounds, it is crucial to prioritize updating your kernel to the patched version to avoid potential risks.
Detailed information can be found in the Debian CVE database or by referring to the Linux kernel documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
