Critical Interrupt Handling Vulnerability in Linux Kernel Package
Summary
DEBIAN-CVE-2024-56680: In the Linux kernel, the following vulnerability has been resolved: media: intel/ipu6: do not handle interrupts when device is disabled Some IPU6 devices have shared interrupts. Affects linux versions < 6.12.3-1. Fixed in 6.12.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It provides essential functionalities such as process management, memory management, and device control. The kernel is modular, allowing for the addition of various drivers and subsystems. However, certain components, like the Intel IPU6, can introduce vulnerabilities if not properly managed, particularly in scenarios involving shared interrupts.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the media subsystem related to the Intel IPU6 device. This issue arises when interrupts are triggered from a device on a shared IRQ line while the IPU6 device is disabled. The kernel incorrectly handles the interrupt, leading to a situation where it receives a value of 0xffffffff from the ISR_STATUS register. This can cause the system to hang, as the kernel is not prepared to manage these unexpected interrupts. The vulnerability is critical as it can lead to system instability and potential denial of service.
How To Fix
Minimum fixed version
6.12.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement checks to ensure that the device is enabled before handling interrupts. This can be done by using the function 'pm_runtime_get_if_active()' to verify the device's status and prevent it from suspending while handling interrupts. Additionally, using 'synchronize_irq()' during the suspend process can help mitigate the issue.
Conclusion
The vulnerability in the Linux kernel related to the Intel IPU6 device presents a significant risk of system instability due to improper interrupt handling. Users are strongly advised to update their kernel to the patched version 6.12.3-1 or later to mitigate this risk. Additionally, implementing the suggested workarounds can provide temporary relief until the update is completed.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper handling of interrupts in the Linux kernel when the Intel IPU6 device is disabled, potentially causing system hangs.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring installation.
Failure to address this vulnerability can lead to system instability, crashes, and denial of service, impacting the overall performance and reliability of the system.
Yes, the vulnerability is fixed in Linux kernel version 6.12.3-1 and later.
Update your Linux kernel package to the latest version using your package manager and consider implementing the suggested workarounds until the update is applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
