Critical Vulnerability in Linux Kernel: Memory Allocation Flaw in HSR Support
Summary
DEBIAN-CVE-2024-56639: In the Linux kernel, the following vulnerability has been resolved: net: hsr: must allocate more bytes for RedBox support Blamed commit forgot to change hsr_init_skb() to allocate larger skb for RedBox case. Affects linux versions < 6.12.5-1. Fixed in 6.12.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, managing hardware and system resources. It provides essential services for all other software running on the system. This vulnerability affects the Linux kernel versions in Debian 13 and 14, specifically related to the HSR (High-availability Seamless Redundancy) protocol, which is used for network redundancy. The flaw arises from inadequate memory allocation for certain data structures, potentially leading to system crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the handling of HSR support, specifically in the function responsible for initializing socket buffers (hsr_init_skb). The issue stems from a commit that failed to allocate sufficient memory for the RedBox case, leading to a buffer overflow. This can result in a kernel panic, as evidenced by a reported crash from syzbot, indicating that the system may become unstable or unresponsive. The vulnerability is tracked under the identifier DEBIAN-CVE-2024-56639.
How To Fix
Minimum fixed version
6.12.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The identified vulnerability in the Linux kernel related to HSR support poses a significant risk of system instability. Users are strongly advised to update their kernel to the patched version 6.12.5-1 to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to a kernel panic, causing the system to crash and become unresponsive.
The vulnerability affects the Linux kernel versions in Debian 13 and 14 prior to the fixed version 6.12.5-1.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Currently, there are no known workarounds. It is recommended to apply the patch as soon as possible.
If immediate updates are not possible, consider isolating affected systems from critical networks until the patch can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
