Double Free of blk_mq_tag_set in dev remove after table load fails in Kernel
Summary
GSD-2021-1000053: dm rq: fix double free of blk_mq_tag_set in dev remove after table load fails. Affects Kernel versions >= 1c357a1e86a4227a6b6059f2de118ae47659cebc, < d757bf4c69cda3c3ab7f775dfabbf5a80e2f6f9d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a fundamental component of the Linux operating system that manages the system's resources and facilitates communication between hardware and software. It provides essential functionalities such as process management, memory management, and device drivers. The vulnerability in question involves a double free of blk_mq_tag_set in dev remove after table load fails.
Vulnerability Detail
The vulnerability occurs when a table load fails in the Kernel's device mapper (dm) request (rq) code. In this scenario, a double free of blk_mq_tag_set is triggered during the removal of the device. This vulnerability can potentially lead to memory corruption and may be exploited by an attacker to execute arbitrary code or cause a denial-of-service (DoS) condition.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid the vulnerability by refraining from loading tables that are known to fail. Additionally, it is advisable to apply the latest security patches and updates to the Kernel to mitigate any potential risks.
Conclusion
In conclusion, the double free of blk_mq_tag_set vulnerability in the Kernel's dm rq code can potentially lead to memory corruption and exploitation by attackers. It is crucial to update the Linux Kernel to version v5.12.3 or later to mitigate this vulnerability. Applying the recommended fixes and updates, along with following security best practices, will help ensure the integrity and security of the system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can potentially lead to memory corruption and may be exploited by an attacker to execute arbitrary code or cause a denial-of-service (DoS) condition.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.12.3 or later. The fix for this issue was implemented in commit d757bf4c69cda3c3ab7f775dfabbf5a80e2f6f9d.
As a workaround, users can avoid the vulnerability by refraining from loading tables that are known to fail. Additionally, it is advisable to apply the latest security patches and updates to the Kernel.
At the time of this report, there are no known instances of this vulnerability being exploited in the wild. However, it is crucial to apply the recommended fixes and updates to ensure the security of the system.
For more details about this vulnerability, you can refer to the source link provided in the database_specific section of this report.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
