Critical Memory Management Vulnerability in Linux Kernel Package
Summary
DEBIAN-CVE-2024-57881: In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: don't call pfn_to_page() on possibly non-existent PFN in split_large_buddy() In split_large_buddy(), we might call pfn_to_page() on a PFN... Affects linux versions < 6.12.8-1. Fixed in 6.12.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It is widely used across various platforms, including servers, desktops, and embedded systems. This vulnerability affects the memory management subsystem, specifically in the handling of page frames, which can lead to system instability and potential data corruption.
Vulnerability Detail
In the Linux kernel, a vulnerability exists in the function split_large_buddy() within the memory management code. This issue arises when the function attempts to call pfn_to_page() on a page frame number (PFN) that may not exist. In specific scenarios, such as freeing the highest pageblock in the last memory section, this can lead to dereferencing a NULL pointer, resulting in a system crash or undefined behavior. The vulnerability has been identified through code inspection and is particularly concerning for systems configured with CONFIG_SPARSEMEM and not using CONFIG_SPARSEMEM_EXTREME.
How To Fix
Minimum fixed version
6.12.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The vulnerability identified in the Linux kernel poses a significant risk to system stability and data integrity. Users are strongly encouraged to update to the patched version 6.12.8-1 to mitigate this risk. Regular monitoring and prompt updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves a potential NULL pointer dereference in the Linux kernel's memory management code, which can lead to system crashes.
You can check your Linux kernel version using the command 'uname -r' and compare it with the patched version 6.12.8-1.
Yes, the vulnerability can lead to system instability, which may result in data corruption or loss.
While there are no specific workarounds, it is advisable to monitor your system closely and apply the patch as soon as possible.
Vulert monitors and alerts in real-time for open-source vulnerabilities using just a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
