Kernel Vulnerability in Linux Package: Memory Leak and Crash Risk Due to ATS Handling
Summary
DEBIAN-CVE-2024-56669: In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Remove cache tags before disabling ATS The current implementation removes cache tags after disabling ATS, leading to potential memory leaks... Affects linux versions < 6.12.6-1. Fixed in 6.12.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It is widely used in various distributions, including Debian. The kernel's stability and security are paramount, as vulnerabilities can lead to system crashes or unauthorized access. This specific vulnerability affects the handling of Address Translation Services (ATS) in the IOMMU subsystem, which is crucial for managing memory in virtualized environments.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the iommu/vt-d subsystem related to the handling of cache tags during the disabling of ATS. The current implementation removes cache tags after ATS is disabled, which can lead to memory leaks and kernel crashes. Specifically, CACHE_TAG_DEVTLB type cache tags may remain in the list even after the domain is freed, resulting in a use-after-free condition. This issue is particularly evident when multiple Virtual Functions (VFs) from different Physical Functions (PFs) are passed to a single user-space process via vfio-pci, potentially causing kernel crashes with NULL pointer dereference errors.
How To Fix
Minimum fixed version
6.12.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available.
Conclusion
The vulnerability in the Linux kernel related to ATS handling poses significant risks, including memory leaks and system crashes. It is crucial for users to update their systems to the patched version to ensure stability and security. Monitoring tools like Vulert can assist in identifying vulnerabilities in open-source software.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to memory leaks and kernel crashes, particularly in virtualized environments where multiple VFs are used.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Yes, a patched version (6.12.6-1) is available for Debian 13 and 14. Updating to this version will resolve the issue.
While there are no specific workarounds, it is advisable to minimize the use of affected features until the patch can be applied.
Detailed information can be found in the CVE report and through security advisories related to the Linux kernel.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
