CVE-2024-36009: linux-libc-dev - Fix netdev refcount issue
Summary
CVE-2024-36009: In the Linux kernel, the following vulnerability has been resolved: ax25: Fix netdev refcount issue The dev_tracker is added to ax25_cb in ax25_bind(). Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux-libc-dev package is a development package that provides the necessary header files and libraries for compiling programs that use the Linux kernel interfaces. It is an essential component for building and running applications on Linux systems. The vulnerability identified as CVE-2024-36009 affects the linux-libc-dev package, specifically in the ax25 module of the Linux kernel.
Vulnerability Detail
The vulnerability in the ax25 module of the Linux kernel allows for a netdev refcount issue. This issue arises when the ax25 device is detaching, as the dev_tracker of ax25_cb is deallocated instead of the dev_tracker of ax25_dev. This can lead to a reference already released error, potentially causing instability or crashes in the system. The vulnerability has a CVSS score of 5.5, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is advised to apply the recommended fix by updating the linux-libc-dev package to the latest version.
Conclusion
The CVE-2024-36009 vulnerability in the linux-libc-dev package's ax25 module has been identified and addressed. It is crucial to update the package to version 6.1.90-1 or later to mitigate the netdev refcount issue. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
linux-libc-dev is a development package that provides header files and libraries for compiling programs that use Linux kernel interfaces.
The ax25 module in the Linux kernel is responsible for implementing the AX.25 protocol, which is used for packet radio communication.
A netdev refcount issue refers to a problem with the reference counting mechanism for network devices in the kernel. In this vulnerability, the incorrect deallocation of the dev_tracker can lead to a reference already released error.
The CVSS score for this vulnerability is 5.5, indicating a medium severity level.
You can update the linux-libc-dev package by using the package management system of your Linux distribution or by downloading the updated package from the official Debian repositories.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
