CVE-2024-25743: linux-libc-dev - hw: amd: Instruction raise #VC exception at exit
Summary
CVE-2024-25743: In the Linux kernel through 6.9, an untrusted hypervisor can inject virtual interrupts 0 and 14 at any point in time and can trigger the SIGFPE signal handler in userspace applications. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
linux-libc-dev is a package in the Debian operating system that provides the C library development files for the Linux kernel. It is responsible for providing the necessary headers and libraries for compiling and linking C programs against the Linux kernel. This vulnerability affects version 6.1.90-1 of the linux-libc-dev package. The package is used by developers to build applications that interact with the Linux kernel.
Vulnerability Detail
The vulnerability identified as CVE-2024-25743 affects the linux-libc-dev package in the Linux kernel through version 6.9. It allows an untrusted hypervisor to inject virtual interrupts 0 and 14 at any point in time, triggering the SIGFPE signal handler in userspace applications. This vulnerability specifically impacts AMD SEV-SNP and AMD SEV-ES. An attacker with access to the hypervisor can exploit this vulnerability to execute arbitrary code or cause a denial of service. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.1.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The linux-libc-dev package in the Linux kernel is vulnerable to an untrusted hypervisor injecting virtual interrupts, potentially leading to the execution of arbitrary code or a denial of service. Users are advised to update to a patched version of the package and follow secure hypervisor configuration practices to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
linux-libc-dev is a package in the Debian operating system that provides the C library development files for the Linux kernel. It is used by developers to build applications that interact with the Linux kernel.
This vulnerability allows an untrusted hypervisor to inject virtual interrupts, potentially leading to the execution of arbitrary code or a denial of service.
The vulnerability affects version 6.1.90-1 of the linux-libc-dev package.
Updating to a patched version of the linux-libc-dev package is the recommended mitigation for this vulnerability. Additionally, following secure hypervisor configuration and isolation practices can help minimize the risk of exploitation.
The CVSS score of this vulnerability is 7.1, indicating a high severity.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
