CVE-2024-35887: linux-libc-dev - Use-after-free bugs caused by ax25_ds_del_timer
Summary
CVE-2024-35887: In the Linux kernel, the following vulnerability has been resolved: ax25: fix use-after-free bugs caused by ax25_ds_del_timer When the ax25 device is detaching, the ax25_dev_device_down() calls ax25_ds_del_timer() to cle... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
linux-libc-dev is a package that provides the Linux kernel headers for use in userspace. It allows developers to compile and build applications that interact with the Linux kernel. This package is an essential component for building and running software on Linux systems. However, a vulnerability has been discovered in the ax25 subsystem of the Linux kernel, which is addressed in this package.
Vulnerability Detail
The vulnerability (CVE-2024-35887) in the ax25 subsystem of the Linux kernel allows for use-after-free bugs to occur due to improper handling of timers during device detachment. When the ax25 device is being detached, the ax25_dev_device_down() function calls ax25_ds_del_timer() to clean up the slave_timer. However, if the timer handler is running at the same time, the del_timer() function can return directly, leading to use-after-free bugs. This vulnerability can be exploited by an attacker to potentially execute arbitrary code or cause a denial-of-service condition.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring they have the latest security updates installed and following best practices for system security.
Conclusion
The linux-libc-dev package is vulnerable to a use-after-free bug in the ax25 subsystem of the Linux kernel. This vulnerability can potentially be exploited by an attacker to execute arbitrary code or cause a denial-of-service condition. It is crucial to update the linux-libc-dev package to version 6.1.90-1 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
linux-libc-dev is a package that provides the Linux kernel headers for use in userspace. It is essential for compiling and building applications that interact with the Linux kernel.
This vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition on a system running the affected version of the linux-libc-dev package.
To fix this vulnerability, it is recommended to update the linux-libc-dev package to version 6.1.90-1 or later. This updated version includes a fix for the use-after-free bugs caused by ax25_ds_del_timer.
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring they have the latest security updates installed and following best practices for system security.
More information about this vulnerability can be found on the Debian Security Tracker website and the National Vulnerability Database (NVD).
Related vulnerabilities
Recent vulnerabilities recorded for linux.
