ovl: Fix Leaked Dentry in Linux Kernel
Summary
GSD-2021-1000157: ovl: fix leaked dentry. Affects Kernel versions >= 6815f479ca90ee7fd2e28b2a420f796b974155fe, < 71d58457a8afc650da5d3292a7f7029317654d95. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system. It provides essential services and functions for the system's operation, including managing hardware resources, providing system calls, and implementing various subsystems. The OverlayFS (ovl) is a filesystem implementation in the Linux Kernel that allows multiple layers of directories and files to be combined into a single virtual filesystem. It is commonly used in containerization technologies like Docker. However, a vulnerability has been discovered in the OverlayFS implementation that can lead to a leaked dentry, potentially impacting the security and stability of the system.
Vulnerability Detail
The vulnerability in the OverlayFS implementation allows for a leaked dentry, which is a data structure used to represent directory entries in the filesystem. This can occur when a directory is deleted while it is still in use, leading to a reference to the deleted directory being retained. An attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive information or disrupt the system's operation. The vulnerability was introduced in version v5.8 of the Linux Kernel and has been fixed in version v5.10.35.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Linux Kernel is not immediately feasible, a possible workaround is to disable the OverlayFS module. This can be done by removing the 'overlay' module from the kernel modules list or blacklisting it. However, this workaround may impact the functionality of applications or services that rely on OverlayFS.
Conclusion
The vulnerability in the OverlayFS implementation of the Linux Kernel can lead to a leaked dentry, potentially compromising the security and stability of the system. It is crucial to update the Linux Kernel to version v5.10.35 or later to fix this vulnerability. If immediate updating is not possible, disabling the OverlayFS module can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
OverlayFS is a filesystem implementation in the Linux Kernel that allows multiple layers of directories and files to be combined into a single virtual filesystem. It is commonly used in containerization technologies like Docker.
The vulnerability occurs when a directory is deleted while it is still in use, leading to a leaked dentry. This can happen due to improper handling of directory deletion in the OverlayFS implementation.
The leaked dentry can be exploited by an attacker to gain unauthorized access to sensitive information or disrupt the system's operation. It can also potentially be used as a stepping stone for further attacks.
Yes, the vulnerability has been fixed in version v5.10.35 of the Linux Kernel. It is recommended to update to this version or later to mitigate the risk.
A possible workaround is to disable the OverlayFS module by removing or blacklisting the 'overlay' module. However, this may impact the functionality of applications or services that rely on OverlayFS.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
