CVE-2024-36029: Vulnerability in linux-libc-dev package - mmc: sdhci-msm: prevent access to suspended controller
Summary
CVE-2024-36029: In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-msm: pervent access to suspended controller Generic sdhci code registers LED device and uses host->runtime_suspended flag to protect access t... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The linux-libc-dev package is a development package that provides the necessary header files and libraries for compiling programs that use the Linux kernel's C library interface. It is an essential component for building and running applications on Linux systems. The package is commonly used by developers to create and compile software that interacts with the kernel. However, a vulnerability has been discovered in the package that could potentially lead to a crash when accessing the LED device while the controller is in a runtime suspended state.
Vulnerability Detail
The vulnerability in the linux-libc-dev package lies in the sdhci-msm driver, which fails to set the host->runtime_suspended flag. This flag is used to protect access to the LED device in the generic sdhci code. As a result, when the LED is accessed while the controller is in a runtime suspended state, it can cause a crash. This vulnerability could be exploited by an attacker to disrupt the normal operation of the system. The severity of this vulnerability is rated as MEDIUM with a CVSS score of 5.5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Updating the linux-libc-dev package to the latest version is the recommended solution.
Conclusion
The linux-libc-dev package is vulnerable to a medium-severity issue in the sdhci-msm driver, which can cause a crash when accessing the LED device while the controller is in a runtime suspended state. To mitigate this vulnerability, it is recommended to update the linux-libc-dev package to version 6.1.90-1 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
The linux-libc-dev package provides header files and libraries for compiling programs that use the Linux kernel's C library interface. It is essential for building and running applications on Linux systems.
The sdhci-msm driver is a specific driver for SDHCI controllers on Qualcomm MSM platforms. It is responsible for handling communication with SD cards and other SDHCI-compatible devices.
The host->runtime_suspended flag is used in the generic sdhci code to protect access to the LED device. It ensures that the LED is not accessed while the controller is in a runtime suspended state, preventing potential crashes or other issues.
The vulnerability could lead to a crash when accessing the LED device while the controller is in a runtime suspended state. This could disrupt the normal operation of the system and potentially be exploited by an attacker to cause further harm.
The severity of this vulnerability is rated as MEDIUM with a CVSS score of 5.5.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
