CVE-2024-27408: Vulnerability in linux-libc-dev package - DMA race condition
Summary
CVE-2024-27408: In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup The Linked list element and pointer are not stored in the same... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux-libc-dev package is a development package that provides the necessary C library headers and static libraries for compiling and linking programs against the Linux kernel. It is an essential component for building and running applications on Linux systems. The package contains various functions and definitions required for system calls, memory management, file operations, and more. However, the package is vulnerable to a race condition in the DMA engine, specifically in the dw-edma module.
Vulnerability Detail
The vulnerability (CVE-2024-27408) in the linux-libc-dev package arises from a race condition in the dw-edma DMA engine. The issue occurs when the doorbell register is toggled before the full write of the linked list, leading to a race condition error. In remote setup scenarios, where only a readl to the memory is possible, there is no assurance of a complete write. This vulnerability can be exploited by an attacker to cause unexpected behavior or denial of service. The severity of this vulnerability is rated as MEDIUM with a CVSS score of 5.5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, applying the recommended fix by updating the linux-libc-dev package to the latest version will mitigate the issue.
Conclusion
The linux-libc-dev package is vulnerable to a race condition in the dw-edma DMA engine. To mitigate this vulnerability, it is crucial to update the package to version 6.1.90-1 or later. This update includes the necessary fixes to address the race condition. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
The linux-libc-dev package provides C library headers and static libraries for compiling and linking programs against the Linux kernel. It is essential for building and running applications on Linux systems.
The dw-edma DMA engine is a component in the Linux kernel responsible for handling direct memory access operations. It allows data to be transferred between devices and memory without involving the CPU.
A race condition is a software vulnerability that occurs when multiple processes or threads access shared resources concurrently, leading to unexpected or erroneous behavior.
Exploiting this vulnerability could result in unexpected behavior or denial of service. An attacker may be able to manipulate the race condition to gain unauthorized access or disrupt the normal operation of the system.
You can update the linux-libc-dev package by using the package manager of your Linux distribution. For Debian-based systems, you can run 'sudo apt-get update' followed by 'sudo apt-get upgrade linux-libc-dev' to install the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
