Vulnerability in dmaengine: idxd package - WQCFG Register Cleanup
Summary
GSD-2021-1000026: dmaengine: idxd: fix wq cleanup of WQCFG registers. Affects Kernel versions >= da32b28c95a79e399e18c03f8178f41aec9c66e4, < f7dc8f5619165e1fa3383d0c2519f502d9e2a1a9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dmaengine: idxd package is a component of the Linux Kernel that provides support for Intel Data Streaming Accelerator (IDXD) devices. These devices are used for offloading data movement tasks from the CPU, improving performance in data-intensive applications. The package includes various work queues (WQ) that manage the execution of tasks. However, a vulnerability has been discovered in the cleanup process of the WQCFG registers, which could lead to potential security issues.
Vulnerability Detail
The vulnerability in the dmaengine: idxd package affects the cleanup of WQCFG registers. When cleaning up a work queue, the WQCFG registers are not properly reset, potentially leaving sensitive information or configuration settings from previous tasks accessible to unauthorized users. This could result in information disclosure or unauthorized manipulation of the work queue, leading to a variety of security risks. The vulnerability was introduced in version v5.8 of the Linux Kernel and has been fixed in version v5.11.16.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is recommended to apply the fix by updating to the latest version of the Linux Kernel.
Conclusion
The vulnerability in the dmaengine: idxd package's WQCFG register cleanup process can potentially lead to security risks such as information disclosure and unauthorized manipulation of work queues. It is crucial to update the Linux Kernel to version v5.11.16 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The dmaengine: idxd package is a component of the Linux Kernel that provides support for Intel Data Streaming Accelerator (IDXD) devices. These devices offload data movement tasks from the CPU, improving performance in data-intensive applications.
A work queue (WQ) in the dmaengine: idxd package is responsible for managing the execution of tasks offloaded to the Intel Data Streaming Accelerator (IDXD) devices. It ensures efficient processing and coordination of data movement operations.
WQCFG registers are configuration registers associated with the work queues (WQ) in the dmaengine: idxd package. They store various settings and parameters related to the operation of the work queues.
The vulnerability in the dmaengine: idxd package could lead to information disclosure or unauthorized manipulation of work queues. This could result in the exposure of sensitive information or the execution of unauthorized tasks, potentially compromising the security and integrity of the system.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
