Critical Overflow Vulnerability in Linux Kernel Package: linux (Debian 13 & 14)
Summary
DEBIAN-CVE-2024-57843: In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix overflow inside virtnet_rq_alloc When the frag just got a page, then may lead to regression on VM. Affects linux versions < 6.12.5-1. Fixed in 6.12.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It is known for its stability, performance, and security features. However, like any software, it is susceptible to vulnerabilities that can impact system reliability and security. This specific vulnerability affects the 'linux' package in Debian versions 13 and 14, which are widely used in various environments, including servers and personal computers.
Vulnerability Detail
In the Linux kernel, a critical overflow vulnerability has been identified in the virtio-net subsystem. This issue arises when the frag size is larger than PAGE_SIZE, leading to potential crashes or failures during file transfers, particularly when the sysctl net.core.high_order_alloc_disable value is set to 1. The vulnerability was introduced by commit f9dac92ba908, which enabled premapped mode without adequately addressing buffer size calculations. As a result, when the frag size is insufficient, an overflow may occur, compromising system stability and reliability.
How To Fix
Minimum fixed version
6.12.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can adjust the sysctl net.core.high_order_alloc_disable value to 0, which may help mitigate the risk of encountering this overflow issue until the package is updated. This can be done with the command: 'sudo sysctl -w net.core.high_order_alloc_disable=0'.
Conclusion
The overflow vulnerability in the Linux kernel's virtio-net subsystem poses significant risks to system stability and reliability. Users are strongly encouraged to update their 'linux' package to the patched version 6.12.5-1 to mitigate these risks. Until an update can be applied, implementing the suggested workaround may help reduce the likelihood of encountering issues.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes or failures during file transfers, particularly when using virtual machines.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The vulnerability affects the 'linux' package in Debian versions 13 and 14.
Yes, updating to the patched version 6.12.5-1 will resolve the vulnerability.
Consider applying the temporary workaround by adjusting the sysctl net.core.high_order_alloc_disable value to mitigate risks until an update can be performed.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
