Bug#1099138: linux: CVE-2024-45001 in bookworm

From	Noah Meyerhans <noahm@debian.org>
Newsgroups	linux.debian.bugs.dist, linux.debian.kernel
Subject	Bug#1099138: linux: CVE-2024-45001 in bookworm
Date	2025-03-01 14:30 +0100
Message-ID	<Klv4J-2Q7L-5@gated-at.bofh.it> (permalink)
References	(1 earlier) <KldUd-2DDX-1@gated-at.bofh.it> <Klenf-2DQc-13@gated-at.bofh.it> <KluV3-2Q3A-1@gated-at.bofh.it> <KldUd-2DDX-1@gated-at.bofh.it> <KluV3-2Q3A-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

On Sat, Mar 01, 2025 at 02:15:43PM +0100, Salvatore Bonaccorso wrote:
> > > Source: linux
> > > Version: 6.1.128-1
> > > Severity: important
> > > Tags: security
> > > X-Debbugs-Cc: Debian Security Team <team@security.debian.org>
> > > 
> > > I believe CVE-2024-45001 (RX buf alloc_size alignment and atomic op 
> > > panic) is miscategorized as not impacting bookworm.  The issue is with 
> > > the net/ethernet/microsoft/mana driver and was introduced in linux 6.10,
> > > which is likely why the security-tracker contains the note "Vulnerable 
> > > code not present" for bookworm.  However, bookworm contains a backported
> > > version of this driver from 6.10 in
> > > debian/patches/features/all/ethernet-microsoft. [1] [2]
> > > 
> > > The upstream fix applies on top of our patched 6.1 kernel with an 
> > > offset. [3]
> > > 
> > > I didn't propose a fix to the security-tracker data because I don't know
> > > the file format well enough.
> > > 
> > > I can prepare a merge request to the kernel package if that would help.
> > 
> > Thanks I will shortly have a look at that as I'm rebasing 6.1.y for
> > bookworm for the next upload.
> 
> Investigating this further I believe we have the same problem as well
> for CVE-2024-42069.

Yes, that seems likely.

noah

Back to linux.debian.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Bug#1099138: linux: CVE-2024-45001 in bookworm Noah Meyerhans <noahm@debian.org> - 2025-02-28 20:10 +0100
  Bug#1099138: linux: CVE-2024-45001 in bookworm Salvatore Bonaccorso <carnil@debian.org> - 2025-02-28 20:40 +0100
    Bug#1099138: linux: CVE-2024-45001 in bookworm Salvatore Bonaccorso <carnil@debian.org> - 2025-03-01 14:20 +0100
      Bug#1099138: linux: CVE-2024-45001 in bookworm Noah Meyerhans <noahm@debian.org> - 2025-03-01 14:30 +0100

csiph-web