Kernel Panic Vulnerability in Linux Package: DM Request Queue Management During Suspend
Summary
CVE-2021-47498: In the Linux kernel, the following vulnerability has been resolved: dm rq: don't queue request to blk-mq during DM suspend DM uses blk-mq's quiesce/unquiesce to stop/start device mapper queue. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware and system resources. It provides essential services for all other parts of the system, including process management, memory management, and device control. The device mapper (DM) is a kernel component that allows the creation of virtual block devices, enabling advanced storage management features. This vulnerability affects the DM's ability to manage request queues during suspend operations, potentially leading to system instability.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified in the device mapper (DM) related to its request queue management during suspend operations. The issue arises when DM uses the block multi-queue (blk-mq) system to stop and start its request queue. If an external event triggers an unquiesce during this suspend period, requests may be queued improperly, leading to kernel panic. This vulnerability can cause system crashes, particularly during stress tests involving device mapper suspend and resume operations.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the kernel update as soon as possible to mitigate the risk.
Conclusion
The CVE-2021-47498 vulnerability in the Linux kernel poses a significant risk due to its potential to cause kernel panic during device mapper operations. Users are strongly advised to update their kernel to the latest version to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2021-47498 is a vulnerability in the Linux kernel that affects the device mapper's request queue management during suspend operations, potentially leading to kernel panic.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
The primary consequence of this vulnerability is the potential for kernel panic, which can lead to system crashes and instability during specific operations involving the device mapper.
Yes, it is recommended to upgrade to at least version 5.14.16-1 of the Linux kernel to ensure that the vulnerability is patched.
More information can be found in the official CVE database and through the Linux kernel mailing lists where patches and discussions are published.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
