CVE-2024-40944: x86/kexec: Fix bug with call depth tracking
In the Linux kernel, the following vulnerability has been resolved:
x86/kexec: Fix bug with call depth tracking
The call to ccplatformhas() triggers a fault and system crash if call depth tracking is active because the GS segment has been reset by loadsegments() and GSBASE is now 0 but call depth tracking uses per-CPU variables to operate.
Call ccplatformhas() earlier in the function when GS is still valid.
[ bp: Massage. ]
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40944?
CVE-2024-40944 has a medium severity level due to its potential to cause system crashes.
How does CVE-2024-40944 impact the Linux kernel?
CVE-2024-40944 can lead to fault and system crashes when call depth tracking is active.
How do I fix CVE-2024-40944?
To fix CVE-2024-40944, update to the patched versions of the Linux kernel, such as 5.10.223-1 or 6.12.12-1.
Which versions of the Linux kernel are affected by CVE-2024-40944?
CVE-2024-40944 affects specific versions of the Linux kernel prior to the patches, including 5.10.223-1 and 6.1.119-1.
Is CVE-2024-40944 specific to any Linux distribution?
CVE-2024-40944 is noted in the Debian distribution, where the affected Linux kernel versions are used.