CVE-2024-42150: 
Linux Debian vulnerability analysis and mitigation

CVE-2024-42150 affects the Linux kernel's network driver component, specifically the txgbe driver. The vulnerability was discovered and disclosed on July 30, 2024, and involves a conflict between interrupt request handlers that could lead to system crashes. The issue affects Linux kernel versions from 6.8.12 up to (excluding) 6.9, from 6.9 up to (excluding) 6.9.9, and various 6.10 release candidates (NVD).

The vulnerability occurs when using MSI (Message Signaled Interrupts) or INTx interrupts in the txgbe network driver. The issue arises from a conflict between request_irq() for pdev->irq and request_threaded_irq() for txgbe->misc.irq, which can trigger a system crash. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium), with a vector string of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local access requirements and potential high impact on system availability (NVD).

The primary impact of this vulnerability is system stability, as it can cause the system to crash when the interrupt request conflict occurs. The CVSS scoring indicates no impact on confidentiality or integrity, but a high impact on availability, suggesting that successful exploitation could lead to system denial of service (NVD).

The vulnerability requires local access and low complexity to exploit, as indicated by the CVSS metrics. It does not require user interaction but does need privileged access to the system. The vulnerability is specifically tied to the hardware interrupt handling mechanism in the txgbe driver (NVD).

The vulnerability has been fixed by removing the separate IRQ request for MSI and INTx cases in the txgbe driver. The fix includes renaming txgbe_request_msix_irqs() to txgbe_request_queue_irqs() since it only requests queue IRQs, and adding wx->misc_irq_domain to determine whether the driver creates an IRQ domain and threaded request the IRQs. The patch has been committed to the Linux kernel (Kernel Patch).