CVE-2024-35817: linux-libc-dev - amdgpu_ttm_gart_bind set gtt bound flag
Summary
CVE-2024-35817: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag Otherwise after the GTT bo is released, the GTT and gart space is freed but amdgpu_ttm_backend_unbin... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
linux-libc-dev is a package in the Debian operating system that provides the C library headers for the Linux kernel. These headers are necessary for compiling and linking programs that use functions from the kernel. The linux-libc-dev package is an essential component for developers working on Linux-based systems. However, a vulnerability has been discovered in the package that could potentially lead to undefined behavior and system instability.
Vulnerability Detail
The vulnerability in linux-libc-dev, identified as CVE-2024-35817, lies in the amdgpu_ttm_gart_bind function of the drm/amdgpu module. When the GTT (Graphics Translation Table) bo (Buffer Object) is released, the GTT and gart space are freed. However, the amdgpu_ttm_backend_unbind function fails to clear the gart page table entry, leaving a valid mapping entry pointing to a stale system page. This can result in the GPU accessing the gart address and reading undefined values instead of triggering a page fault. This makes it harder to debug and reproduce the actual issue, potentially leading to unexpected behavior and security risks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability. It is recommended to follow the official updates and patches provided by the Debian Security Tracker.
Conclusion
The linux-libc-dev package in Debian is vulnerable to the amdgpu_ttm_gart_bind set gtt bound flag issue, which can result in undefined behavior and system instability. It is crucial to update the package to a patched version provided by the Debian Security Tracker to mitigate the risks associated with this vulnerability. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for linux →
FAQ
linux-libc-dev is a package in the Debian operating system that provides the C library headers for the Linux kernel. These headers are necessary for compiling and linking programs that use functions from the kernel.
The vulnerability in linux-libc-dev can result in undefined behavior and system instability. It can make it harder to debug and reproduce actual issues, potentially leading to unexpected behavior and security risks.
To fix this vulnerability, it is recommended to update the linux-libc-dev package to a version that includes the necessary patches. Regularly check for updates and apply them promptly to ensure the security and stability of the system.
No specific workaround has been mentioned for this vulnerability. It is recommended to follow the official updates and patches provided by the Debian Security Tracker.
You can find more information about this vulnerability on the Debian Security Tracker website and the National Vulnerability Database (NVD).
Related vulnerabilities
Recent vulnerabilities recorded for linux.
