CVE-2024-26947: linux-libc-dev - ARM: flush: check if the folio is reserved for no-mapping addresses
Summary
CVE-2024-26947: In the Linux kernel, the following vulnerability has been resolved: ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses Since commit a4d5613c4dc6 ("arm: extend pfn_valid to take into account freed... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
linux-libc-dev is a package in the Debian operating system that provides the C library development files for the Linux kernel. It is an essential component for compiling and linking programs on Debian-based systems. The package contains header files and libraries that are necessary for developing applications that interact with the kernel. The linux-libc-dev package is widely used and plays a critical role in the functioning of various software on Debian systems.
Vulnerability Detail
The vulnerability identified as CVE-2024-26947 affects the linux-libc-dev package. It arises from a change in the semantics of the pfn_valid() function, introduced in commit a4d5613c4dc6. This change modifies the behavior of pfn_valid() to check for the presence of the memory map for a Page Frame Number (PFN). However, this alteration leads to a system crash when a valid page for an address that is reserved but not mapped by the kernel is encountered. The vulnerability primarily impacts ARM architecture systems. Exploiting this vulnerability can result in a kernel panic, leading to a denial of service (DoS) condition. The vulnerability has a CVSS score of 5.5, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The linux-libc-dev package in Debian is vulnerable to a flaw that can lead to a system crash on ARM architecture systems. It is crucial to update the package to version 6.1.90-1 or later to mitigate this vulnerability. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
The linux-libc-dev package, specifically version 6.1.90-1, is affected by this vulnerability.
Exploiting this vulnerability can lead to a kernel panic and a denial of service (DoS) condition.
Yes, this vulnerability primarily affects systems using the ARM architecture.
This vulnerability has a CVSS score of 5.5, indicating a medium severity level.
To fix this vulnerability, update the linux-libc-dev package to version 6.1.90-1 or later.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
