Memory Corruption Risk in Linux Kernel: Linux Package Vulnerability DEBIAN-CVE-2024-58003
Summary
DEBIAN-CVE-2024-58003: In the Linux kernel, the following vulnerability has been resolved: media: i2c: ds90ub9x3: Fix extra fwnode_handle_put() The ub913 and ub953 drivers call fwnode_handle_put(priv->sd.fwnode) as part of their remove process... Affects linux versions < 6.12.15-1. Fixed in 6.12.15-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It supports a wide range of functionalities, including process management, memory management, device drivers, and system calls. The vulnerability identified as DEBIAN-CVE-2024-58003 affects the Linux package in Debian versions 13 and 14, specifically related to the media i2c subsystem, which handles communication with various media devices.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the ub913 and ub953 drivers within the media i2c subsystem. The issue arises from the improper handling of fwnode_handle_put() calls during the driver removal process. If the driver is removed multiple times, it can lead to a 'put overflow,' which may result in memory corruption or system crashes. This vulnerability stems from a leftover code from a previous commit that altered the handling of the sd.fwnode but failed to remove the redundant fwnode_handle_put() calls.
How To Fix
Minimum fixed version
6.12.15-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users should avoid removing the affected drivers multiple times until the patch is applied.
Conclusion
The vulnerability DEBIAN-CVE-2024-58003 poses a significant risk to systems running the affected versions of the Linux kernel in Debian. Users are strongly advised to update their packages to the patched version to mitigate potential memory corruption and system crashes.
See every vulnerability recorded for linux →
FAQ
DEBIAN-CVE-2024-58003 is a vulnerability in the Linux kernel that can lead to memory corruption or crashes due to improper handling of driver removal.
Debian versions 13 and 14 are affected by this vulnerability in the Linux package.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If you cannot update your package immediately, avoid removing the affected drivers multiple times to mitigate the risk of memory corruption.
More information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-58003.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
