Double Free of blk_mq_tag_set in dev remove after table load fails
Summary
GSD-2021-1000131: dm rq: fix double free of blk_mq_tag_set in dev remove after table load fails. Affects Kernel versions >= 1c357a1e86a4227a6b6059f2de118ae47659cebc, < 1cb02dc76f4c0a2749a02b26469512d6984252e9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vulnerability affects the Kernel package in the Linux ecosystem. The Kernel is the core component of the operating system that manages system resources and provides an interface for software to interact with the hardware. It is responsible for tasks such as process management, memory management, and device drivers. The vulnerability specifically impacts the dm rq module, which is responsible for handling requests in the device mapper subsystem. The vulnerability arises when a double free of blk_mq_tag_set occurs during the removal of a device after a table load fails.
Vulnerability Detail
The vulnerability occurs in the dm rq module when a device removal is attempted after a table load fails. During this process, a double free of blk_mq_tag_set is triggered, leading to a potential use-after-free vulnerability. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial of service. The vulnerability was introduced in version v4.6 of the Linux Kernel and is fixed in version v5.10.36.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in the Kernel package, specifically in the dm rq module, allows for a double free of blk_mq_tag_set during device removal after a table load failure. This can lead to a use-after-free vulnerability, potentially enabling arbitrary code execution or denial of service. It is crucial to update the Linux Kernel to version v5.10.36 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability could potentially allow an attacker to execute arbitrary code or cause a denial of service.
You can use Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will alert you in real-time if any open-source vulnerabilities, including this one, are detected.
At the time of this report, there is no known exploit for this vulnerability. However, it is always recommended to apply security patches promptly to mitigate the risk.
The vulnerability itself does not provide remote exploitation capabilities. However, if an attacker already has access to the system, they could potentially exploit this vulnerability to escalate their privileges or disrupt system operations.
The primary mitigation for this vulnerability is to update the Linux Kernel to the fixed version. Additionally, it is recommended to follow security best practices such as restricting access to privileged accounts and implementing network segmentation to minimize the potential impact of a successful exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
