Fix ordering in queued_write_lock_slowpath vulnerability in Kernel
Summary
GSD-2021-1000044: locking/qrwlock: Fix ordering in queued_write_lock_slowpath(). Affects Kernel versions >= b519b56e378ee82caf9b079b04f5db87dedc3251, < 82fa9ced35d88581cffa4a1c856fc41fca96d80a. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that manages system resources and facilitates communication between hardware and software. It provides essential functionalities such as process management, memory management, and device drivers. The vulnerability in question affects the locking/qrwlock module of the Kernel. The qrwlock (queued read-write lock) is a synchronization primitive used to control concurrent access to shared resources. It ensures that multiple readers can access the resource simultaneously, while exclusive write access is granted to a single thread. However, a flaw in the ordering of operations in the queued_write_lock_slowpath() function can lead to potential security vulnerabilities.
Vulnerability Detail
The vulnerability arises from incorrect ordering in the queued_write_lock_slowpath() function of the locking/qrwlock module. This flaw can potentially be exploited by malicious actors to gain unauthorized access to shared resources or disrupt the normal functioning of the system. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in Linux Kernel version v5.10.33 by commit 82fa9ced35d88581cffa4a1c856fc41fca96d80a. However, it was introduced in version v4.15 by commit b519b56e378ee82caf9b079b04f5db87dedc3251.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As this vulnerability has been fixed in the latest version of the Kernel, there is no specific workaround available. It is recommended to update the Kernel to the fixed version.
Conclusion
The vulnerability in the locking/qrwlock module of the Kernel, specifically in the queued_write_lock_slowpath() function, has been identified and fixed in Linux Kernel version v5.10.33. Users are advised to update their Kernel to the fixed version to mitigate the potential risks associated with this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel is a critical component of the Linux operating system that manages system resources and facilitates communication between hardware and software.
The locking/qrwlock module is responsible for providing a synchronization primitive called qrwlock (queued read-write lock) in the Kernel. It ensures concurrent access to shared resources while maintaining data integrity.
The impact of this vulnerability can vary depending on the specific use case. It could potentially allow unauthorized access to shared resources or disrupt the normal functioning of the system.
To fix this vulnerability, it is recommended to update the Kernel to version v5.10.33 or later. This can be done by pulling the latest changes from the official Linux Kernel repository and rebuilding the Kernel.
As this vulnerability has been fixed in the latest version of the Kernel, there is no specific workaround available. It is recommended to update the Kernel to the fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
