Improper Failure Indication in md/raid1 in Linux Kernel
Summary
GSD-2021-1000067: md/raid1: properly indicate failure when ending a failed write request. Affects Kernel versions >= eeba6809d8d58908b5ed1b5ceb5fcb09a98a7cad, < 538244fba59fde17186322776247cd9c05be86dd. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is a widely used open-source operating system kernel that serves as the foundation for various Linux distributions. It provides essential functionality for managing system resources, including memory, processes, and hardware devices. The md/raid1 module within the Linux Kernel is responsible for implementing RAID 1 (Redundant Array of Independent Disks) functionality, which involves mirroring data across multiple disks for fault tolerance. However, a vulnerability has been identified in the md/raid1 module that can lead to improper failure indication during the handling of failed write requests.
Vulnerability Detail
The vulnerability in the md/raid1 module occurs when ending a failed write request. It fails to properly indicate the failure, potentially leading to incorrect error handling or data corruption. An attacker could exploit this vulnerability to manipulate the system's behavior, cause data loss, or disrupt the availability of the affected system. The vulnerability was introduced in version v5.4 of the Linux Kernel and has been fixed in version v5.12.3.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
A workaround for this vulnerability is to disable or avoid using the md/raid1 module until the Linux Kernel is updated to a fixed version. This can be achieved by unloading the module or preventing it from loading during system startup. However, this workaround may not be feasible for systems heavily reliant on RAID 1 functionality.
Conclusion
The vulnerability in the md/raid1 module of the Linux Kernel can result in improper failure indication during the handling of failed write requests. It is crucial to update the Linux Kernel to version v5.12.3 or later to mitigate this vulnerability. Users can also utilize Vulert's playground (https://vulert.com/scanner) to check if their system is affected and obtain further support for vulnerability remediation.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to improper failure indication in the md/raid1 module, potentially resulting in incorrect error handling, data corruption, or system disruption.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
There is no information available regarding active exploitation of this vulnerability in the wild at the time of this report.
The primary mitigation for this vulnerability is to update the Linux Kernel to a fixed version. Disabling or avoiding the use of the md/raid1 module can serve as a temporary workaround until the update is applied.
You can refer to the vulnerability details in the GSD database (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1000xxx/GSD-2021-1000067.json) for more information about this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
