CVE-2024-35971: linux-libc-dev - Handle softirqs at the end of IRQ thread to fix hang
Summary
CVE-2024-35971: In the Linux kernel, the following vulnerability has been resolved: net: ks8851: Handle softirqs at the end of IRQ thread to fix hang The ks8851_irq() thread may call ks8851_rx_pkts() in case there are any packets in the... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
linux-libc-dev is a package in the Debian operating system that provides the C library headers for the Linux kernel. These headers are necessary for compiling and building user-space programs that interact with the kernel. The package is an essential component for developers and system administrators working on Debian-based systems. However, a vulnerability has been identified in the package that could lead to system hangs.
Vulnerability Detail
The vulnerability (CVE-2024-35971) in linux-libc-dev arises from an issue in the ks8851_irq() thread, which can call ks8851_rx_pkts() and subsequently netif_rx(). The netif_rx() implementation is protected by local_bh_disable() and local_bh_enable(), which can trigger the execution of softirqs, including net_rx_action. This ultimately reaches the driver .start_xmit callback, resulting in a system hang. The root cause of the hang is the attempt to claim a spinlock that is already locked, leading to a deadlock situation. An attacker could potentially exploit this vulnerability to cause a denial-of-service (DoS) condition on affected systems.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is advised to apply the recommended fix by updating the linux-libc-dev package.
Conclusion
The vulnerability in linux-libc-dev (CVE-2024-35971) can lead to system hangs and potential denial-of-service (DoS) conditions. It is crucial to update the linux-libc-dev package to version 6.1.90-1 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
linux-libc-dev is a package in the Debian operating system that provides the C library headers for the Linux kernel. These headers are necessary for compiling and building user-space programs that interact with the kernel.
The vulnerability in linux-libc-dev can lead to system hangs, potentially causing a denial-of-service (DoS) condition on affected systems.
To fix this vulnerability, it is recommended to update the linux-libc-dev package to version 6.1.90-1 or later.
There is no known workaround for this vulnerability. It is advised to apply the recommended fix by updating the linux-libc-dev package.
More information about this vulnerability can be found in the references provided.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
