Kernel Panic Vulnerability in Linux Package: DEBIAN-CVE-2024-58019
Summary
DEBIAN-CVE-2024-58019: In the Linux kernel, the following vulnerability has been resolved: nvkm/gsp: correctly advance the read pointer of GSP message queue A GSP event message consists three parts: message header, RPC header, message body. Affects linux versions < 6.12.15-1. Fixed in 6.12.15-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It serves as the foundation for various applications and services, ensuring efficient operation and performance. This vulnerability specifically affects the message handling within the Graphics Processing Unit (GPU) subsystem, potentially leading to system instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the nvkm/gsp module, which improperly advances the read pointer of the GSP message queue. This flaw arises when handling multi-page GSP messages, where the system incorrectly interprets the message body of the previous message as the header of the next. This miscalculation can lead to a NULL pointer dereference, resulting in a kernel panic and system crash. The vulnerability is critical as it can cause unexpected behavior and system downtime.
How To Fix
Minimum fixed version
6.12.15-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the affected GPU features or using an alternative driver until the package is updated. This may help mitigate the impact of the vulnerability until a permanent fix is applied.
Conclusion
The DEBIAN-CVE-2024-58019 vulnerability poses a significant risk to systems running the affected Linux kernel versions. It is crucial to apply the available patch promptly to ensure system stability and security. Users are encouraged to monitor their systems for vulnerabilities using tools like Vulert.
See every vulnerability recorded for linux →
FAQ
It is a vulnerability in the Linux kernel affecting the nvkm/gsp module, which can lead to kernel panic due to improper message handling.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to system crashes, instability, and potential data loss due to kernel panics.
Yes, a patch is available in version 6.12.15-1 of the Linux package. It is recommended to update to this version or later.
If immediate updating is not possible, consider disabling the affected GPU features or using an alternative driver as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
