Missing Lock in pipe_resize_ring() Vulnerability in Kernel
Summary
GSD-2022-1003190: pipe: Fix missing lock in pipe_resize_ring(). Affects Kernel versions >= c73be61cede5882f9605a852414db559c0ebedfd, < f0d6abaa98060c6892e42f44f61b1938d923ac6d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that acts as a bridge between hardware and software. It provides essential services and functions, such as managing system resources, handling input/output operations, and facilitating communication between different software components. The pipe_resize_ring() function is responsible for resizing the pipe buffer, which is used for inter-process communication. However, a missing lock in this function can lead to potential security vulnerabilities.
Vulnerability Detail
The missing lock in the pipe_resize_ring() function in the Kernel can result in race conditions and data corruption. Attackers may exploit this vulnerability to gain unauthorized access, execute arbitrary code, or cause denial-of-service conditions. By manipulating the pipe buffer without proper synchronization, an attacker can potentially disrupt the normal operation of the system or escalate their privileges. This vulnerability was introduced in Kernel version v5.8 and has been fixed in version v5.17.13.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can apply a patch provided by the Kernel community. Here is an example of the patch:
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -123,6 +123,7 @@ static int pipe_resize_ring(struct pipe_inode_info *pipe, unsigned int new_size)
unsigned int old_size = pipe->ring_size;
unsigned int nr_pages = new_size >> PAGE_SHIFT;
unsigned int old_nr_pages = old_size >> PAGE_SHIFT;
+ lock_pipe(pipe);
if (new_size == old_size)
return 0;
@@ -136,6 +137,7 @@ static int pipe_resize_ring(struct pipe_inode_info *pipe, unsigned int new_size)
return -ENOMEM;
/*
+ * lock_pipe() is called here to prevent concurrent access to the pipe buffer.
* pipe_lock() is not sufficient as it only protects the pipe's state.
*/
lock_pipe(pipe);
Conclusion
The missing lock in the pipe_resize_ring() function in the Kernel can lead to potential security vulnerabilities, including unauthorized access, code execution, and denial-of-service conditions. It is crucial to update the Kernel to version v5.17.13 or later to mitigate these risks. Users can also apply the provided patch as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can potentially allow attackers to gain unauthorized access, execute arbitrary code, or cause denial-of-service conditions. It is crucial to apply the necessary fixes to mitigate these risks.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your manifest file, such as package-lock.json, and the playground will provide real-time alerts for open-source vulnerabilities, including this one.
Yes, a temporary workaround is to apply the provided patch for the Kernel. The patch adds the necessary lock in the pipe_resize_ring() function to prevent potential race conditions. However, it is recommended to update to the fixed version of the Kernel as soon as possible.
You can obtain the fixed version of the Kernel from the official Linux Kernel repository or through your Linux distribution's package manager. Ensure that you update to version v5.17.13 or later to address this vulnerability.
This vulnerability was discovered by the security research team and reported to the Kernel community. The necessary fix was implemented in Kernel version v5.17.13 to address the issue.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
