Kernel Panic Risk in Linux Packages Due to rq_qos Framework Misuse
Summary
CVE-2021-47412: In the Linux kernel, the following vulnerability has been resolved: block: don't call rq_qos_ops->done_bio if the bio isn't tracked rq_qos framework is only applied on request based driver, so: 1) rq_qos_done_bio() needn... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system processes. It is known for its stability and performance, but vulnerabilities can arise from complex interactions within its architecture. This specific vulnerability affects the rq_qos framework, which is designed to manage request queues in block devices. The issue arises when the framework is improperly invoked for bio-based drivers or untracked bios, leading to potential kernel panics.
Vulnerability Detail
The vulnerability, identified as CVE-2021-47412, originates from the rq_qos framework's handling of bios in the Linux kernel. Specifically, the function rq_qos_done_bio is called even when the bio is not tracked, which can occur in scenarios such as error handling. This improper invocation can lead to dereferencing a potentially freed request queue, resulting in a kernel panic. The ramifications include system instability and crashes, which can affect the overall reliability of systems running vulnerable versions of the Linux kernel.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the necessary updates as outlined in the 'how_to_fix' section.
Conclusion
CVE-2021-47412 presents a significant risk to systems running affected versions of the Linux kernel, potentially leading to kernel panics and system instability. Users are strongly advised to update their kernels to the latest versions to mitigate this risk. Utilizing tools like Vulert can further enhance security by providing real-time vulnerability monitoring.
See every vulnerability recorded for linux →
FAQ
CVE-2021-47412 is a vulnerability in the Linux kernel that can lead to kernel panics due to improper handling of the rq_qos framework.
The vulnerability affects various versions of the Linux kernel across Debian 11, 12, and 13, particularly those prior to version 5.14.12-1.
You can check your system's kernel version by running 'uname -r' in the terminal. If it is below 5.14.12-1, it is vulnerable.
Failure to fix this vulnerability may result in system crashes and instability, which can lead to data loss and downtime.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
