CVE-2024-39478: 
Linux Debian vulnerability analysis and mitigation

CVE-2024-39478 affects the Linux kernel's crypto subsystem, specifically the StarFive RSA implementation. The vulnerability was discovered and disclosed on July 5, 2024, affecting Linux kernel versions from 6.9 up to (excluding) 6.9.5. The issue involves improper handling of RSA text data buffer in the StarFive crypto driver (Kernel Patch).

The vulnerability stems from incorrect memory management in the StarFive RSA driver where a variable length buffer allocated on the software stack is incorrectly freed using kfree(). This causes undefined behavior in subsequent operations. The issue has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local access requirements and potential high impact on availability (NVD).

The vulnerability can lead to undefined behavior in the system's cryptographic operations when using the StarFive RSA implementation. This could potentially result in system instability or crashes, primarily affecting the availability of the system (NVD).

The vulnerability has been fixed in the Linux kernel through a patch that removes the incorrect kfree() call. Users should update to patched versions of the kernel. Ubuntu has released fixes for various kernel versions including 6.8.0-44.44 for Ubuntu 24.04 LTS and corresponding versions for other supported releases (Ubuntu Security).