CVE-2024-26758: Vulnerability in linux-libc-dev package - md: Don't ignore suspended array in md_check_recovery()
Summary
CVE-2024-26758: In the Linux kernel, the following vulnerability has been resolved: md: Don't ignore suspended array in md_check_recovery() mddev_suspend() never stop sync_thread, hence it doesn't make sense to ignore suspended array in... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux-libc-dev package is a development package that provides the necessary C library headers and static libraries for compiling and linking programs against the Linux kernel. It is an essential component for building software that interacts with the kernel. This vulnerability affects version 6.1.90-1 of the linux-libc-dev package.
Vulnerability Detail
The vulnerability in the linux-libc-dev package arises from a flaw in the md_check_recovery() function of the kernel. The mddev_suspend() function does not stop the sync_thread, leading to the ignoring of suspended arrays in md_check_recovery(). This can cause the sync_thread to remain registered and result in a hang condition. An attacker could potentially exploit this vulnerability to disrupt the normal operation of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official patch provided by the package maintainers.
Conclusion
The linux-libc-dev package is vulnerable to a flaw in the md_check_recovery() function, which can lead to a hang condition in the system. It is crucial to update the package to the latest version that includes the necessary patch. Regularly applying security updates is also recommended to mitigate the risk of similar vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
The linux-libc-dev package provides C library headers and static libraries for compiling and linking programs against the Linux kernel.
md_check_recovery() is a function in the kernel that is responsible for checking the recovery status of an MD (Multiple Devices) array.
This vulnerability can potentially lead to a hang condition in the system, causing disruption to normal operations.
No, there is no known workaround. It is recommended to apply the official patch provided by the package maintainers.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and it will provide real-time alerts for open-source vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
