Denial of Service Vulnerability in hwloc Package
Summary
DEBIAN-CVE-2022-47022: An issue was discovered in open-mpi hwloc 2.1.0 allows attackers to cause a denial of service or other unspecified impacts via glibc-cpuset in topology-linux.c. Affects hwloc versions < 2.9.3-1. Fixed in 2.9.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The hwloc package, part of the Open MPI project, provides a portable abstraction of the hierarchical topology of modern architectures, including NUMA memory nodes, shared caches, and processing units. It is widely used in high-performance computing applications to optimize resource allocation and improve performance. However, a vulnerability has been identified in versions prior to 2.9.3-1 that could allow attackers to exploit the glibc-cpuset functionality, leading to potential denial of service.
Vulnerability Detail
An issue was discovered in open-mpi hwloc version 2.1.0 that allows attackers to cause a denial of service or other unspecified impacts via the glibc-cpuset in topology-linux.c. This vulnerability arises from improper handling of certain inputs, which can lead to resource exhaustion or application crashes, severely affecting the performance and availability of applications relying on hwloc.
How To Fix
Minimum fixed version
2.9.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade hwlocTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the use of hwloc functionalities that involve glibc-cpuset until the package is updated. This may involve modifying application configurations to avoid using features that trigger the vulnerability.
Conclusion
The hwloc package has a vulnerability that could lead to denial of service, affecting applications that rely on it. It is crucial to update to the patched version 2.9.3-1 to ensure the security and stability of your applications. For real-time monitoring of vulnerabilities, consider using Vulert, which allows you to check your application without requiring installation.
See every vulnerability recorded for hwloc →
FAQ
hwloc is a software package that provides a portable abstraction of the hierarchical topology of modern architectures, helping optimize resource allocation in high-performance computing.
The vulnerability allows attackers to exploit the glibc-cpuset functionality in hwloc, potentially leading to denial of service or application crashes.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Yes, the patched version of hwloc is 2.9.3-1. It is recommended to update to this version or later to mitigate the vulnerability.
As a temporary measure, limit the use of hwloc functionalities that involve glibc-cpuset until you can update to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for hwloc.
