Denial of Service Vulnerability in Linux Kernel's Xen blkback Implementation
Summary
DEBIAN-CVE-2013-2140: The dispatch_discard_io function in drivers/block/xen-blkback/blkback.c in the Xen blkback implementation in the Linux kernel before 3.10.5 allows guest OS users to cause a denial of service (data loss) via filesystem wr... Affects linux versions < 3.10.1-1. Fixed in 3.10.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware and system resources. The 'linux' package in Debian provides the kernel and its associated modules. This package is crucial for system stability and performance. The vulnerability in question affects the Xen blkback implementation, which is responsible for handling block device requests from guest operating systems in a virtualized environment. This specific vulnerability can lead to data loss when certain operations are performed on read-only disks.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2013-2140 exists in the dispatch_discard_io function within the Xen blkback implementation of the Linux kernel prior to version 3.10.5. It allows guest OS users to execute filesystem write operations on a read-only disk that supports the BLKIF_OP_DISCARD or SCSI UNMAP feature. This can result in a denial of service due to data loss, as the system may incorrectly process these operations, leading to potential corruption or loss of data.
How To Fix
Minimum fixed version
3.10.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patch by updating the package as described above.
Conclusion
The DEBIAN-CVE-2013-2140 vulnerability poses a significant risk to systems using the affected versions of the Linux kernel in a Xen virtualized environment. It is crucial to update the 'linux' package to the patched version to prevent data loss and ensure system integrity.
See every vulnerability recorded for linux →
FAQ
DEBIAN-CVE-2013-2140 is a vulnerability in the Xen blkback implementation of the Linux kernel that can lead to data loss when certain operations are performed on read-only disks.
If your system uses a virtualized environment with Xen and has the affected version of the Linux kernel, it may be susceptible to data loss during specific write operations on read-only disks.
You should update your 'linux' package to the patched version (3.10.1-1 or later) to protect your system from this vulnerability.
While the vulnerability is known, there are no specific exploits publicly documented. However, it is advisable to apply the patch to prevent potential exploitation.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
