CVE-2024-27389: linux-libc-dev - pstore: inode: Only d_invalidate() is needed
Summary
CVE-2024-27389: In the Linux kernel, the following vulnerability has been resolved: pstore: inode: Only d_invalidate() is needed Unloading a modular pstore backend with records in pstorefs would trigger the dput() double-drop warning: W... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
linux-libc-dev is a package in the Debian operating system that provides the C library headers for the Linux kernel. These headers are necessary for compiling and linking programs that use functions provided by the kernel. The linux-libc-dev package is an essential component for developers and system administrators working on Debian-based systems. However, a vulnerability has been identified in the package that could potentially lead to security issues.
Vulnerability Detail
The vulnerability in linux-libc-dev, identified as CVE-2024-27389, relates to the pstore module in the Linux kernel. When unloading a modular pstore backend with records in pstorefs, a double-drop warning occurs due to the incorrect use of d_drop() and dput() functions. This reference counting problem can lead to potential security risks. The issue has been resolved by using d_invalidate() instead of the problematic d_drop()/dput() combination and updating the code to handle error codes appropriately.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability. It is advised to follow the recommended fix and update the linux-libc-dev package to the latest version.
Conclusion
The linux-libc-dev package in Debian is vulnerable to a reference counting issue in the pstore module of the Linux kernel. This vulnerability has been assigned CVE-2024-27389 and has a CVSS score of 5.5. To mitigate the risk, it is crucial to update the linux-libc-dev package to version 6.1.90-1 or later. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
linux-libc-dev is a package in the Debian operating system that provides the C library headers for the Linux kernel. These headers are necessary for compiling and linking programs that use functions provided by the kernel.
The vulnerability in linux-libc-dev can potentially lead to security risks due to a reference counting problem in the pstore module of the Linux kernel. Exploitation of this vulnerability could result in unauthorized access or other malicious activities.
To fix this vulnerability, it is recommended to update the linux-libc-dev package to version 6.1.90-1 or later. This can be done by running the package manager on the Debian system and applying the available updates.
No specific workaround has been mentioned for this vulnerability. It is advised to follow the recommended fix and update the linux-libc-dev package to the latest version.
More information about this vulnerability can be found in the CVE-2024-27389 entry on the National Vulnerability Database (NVD) website.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
