bfq: Update cgroup information before merging bio
Summary
GSD-2022-1002676: bfq: Update cgroup information before merging bio. Affects Kernel versions >= e21b7a0b988772e82e7147e1c659a5afe2ae003c, < 2a1077f17169a6059992a0bbdb330e0abad1e6d9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bfq package is a component of the Linux Kernel, which is responsible for managing the I/O scheduling of block devices. It provides a fair queuing mechanism to prioritize I/O requests from different processes or cgroups. The vulnerability in question arises from a failure to update cgroup information before merging bio (block I/O) requests. This can lead to incorrect I/O prioritization and potential security risks.
Vulnerability Detail
The vulnerability occurs when the bfq package fails to update cgroup information before merging bio requests. This can result in incorrect I/O prioritization, potentially allowing an attacker to manipulate the I/O scheduling and gain unauthorized access to sensitive data. The vulnerability was introduced in version v4.12 of the Linux Kernel and has been fixed in version v5.18.3. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The bfq package in the Linux Kernel is vulnerable to a security issue where cgroup information is not updated before merging bio requests. This can lead to incorrect I/O prioritization and potential unauthorized access to sensitive data. It is recommended to update the Linux Kernel to version v5.18.3 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The bfq package is a component of the Linux Kernel that provides a fair queuing mechanism for I/O scheduling of block devices.
Cgroup information refers to the control group information in the Linux Kernel, which allows for resource allocation and management of processes.
Bio requests, short for block I/O requests, are I/O operations performed on block devices such as hard drives or SSDs.
If this vulnerability is successfully exploited, an attacker may be able to manipulate the I/O scheduling and gain unauthorized access to sensitive data.
Yes, this vulnerability has been fixed in version v5.18.3 of the Linux Kernel.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
