CVE-2024-26876: Vulnerability in linux-libc-dev - Kernel: drm/bridge: adv7511: fix crash on irq during probe
Summary
CVE-2024-26876: In the Linux kernel, the following vulnerability has been resolved: drm/bridge: adv7511: fix crash on irq during probe Moved IRQ registration down to end of adv7511_probe(). Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
linux-libc-dev is a package in the Linux kernel that provides the C library headers for the kernel. It is used by developers to compile and build applications that interact with the kernel. The package is essential for creating and running Linux-based software. However, a vulnerability has been discovered in the package that could lead to a crash during the probe process of the adv7511 DRM bridge. This vulnerability can be exploited if an IRQ (Interrupt Request) is pending during the probe, causing uninitialized data to be used and resulting in a kernel crash.
Vulnerability Detail
The vulnerability in linux-libc-dev (CVE-2024-26876) has been resolved with a fix in the adv7511 DRM bridge. The issue was caused by the registration of an IRQ (Interrupt Request) during the probe process. If an IRQ was already pending before the adv7511_cec_init function, it could lead to the use of uninitialized data and result in a crash. This vulnerability could be exploited by an attacker with local access to the affected system, potentially leading to a denial of service (DoS) condition. The vulnerability has a CVSS score of 4.4, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is advised to apply the recommended fix by updating the linux-libc-dev package to the latest version.
Conclusion
The vulnerability in linux-libc-dev (CVE-2024-26876) has been addressed with a fix in the adv7511 DRM bridge. Users are advised to update the linux-libc-dev package to version 6.1.90-1 or later to mitigate the risk of a crash during the probe process. It is recommended to apply the update as soon as possible to ensure the security and stability of the system. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for linux →
FAQ
linux-libc-dev is a package in the Linux kernel that provides the C library headers for the kernel. It is used by developers to compile and build applications that interact with the kernel.
The adv7511 DRM bridge is a component in the Linux kernel responsible for handling the communication between the kernel and the adv7511 display controller. It enables the display controller to work with the kernel's Direct Rendering Manager (DRM) subsystem.
An IRQ (Interrupt Request) is a signal sent to the processor by a hardware device to request attention. It is used to handle hardware events and can be used to trigger specific actions in the kernel.
A denial of service (DoS) attack is an attempt to disrupt the normal functioning of a system or network by overwhelming it with a flood of illegitimate requests or data. In the context of this vulnerability, a DoS attack can be triggered by exploiting the adv7511 DRM bridge crash, causing the affected system to crash or become unresponsive.
To update the linux-libc-dev package, you can use package management tools like apt-get. Run the following command:
sudo apt-get update sudo apt-get upgrade linux-libc-dev
Related vulnerabilities
Recent vulnerabilities recorded for linux.
