Vulnerability in Kernel Package: blk-iolatency
Summary
GSD-2022-1002653: blk-iolatency: Fix inflight count imbalances and IO hangs on offline. Affects Kernel versions >= 8c772a9bfc7c07c76f4a58b58910452fbb20843b, < 5b0ff3ebbef791341695b718f8d2870869cf1d01. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Kernel package is a fundamental component of the Linux operating system, responsible for managing the system's core functionality. It provides essential services and interfaces for hardware, software, and user applications. One of its modules, blk-iolatency, is designed to control the I/O latency of block devices. This module allows administrators to set limits on the maximum latency for I/O operations, ensuring optimal performance. However, a vulnerability has been discovered in blk-iolatency that can lead to imbalances in the inflight count and cause I/O hangs when the device is offline.
Vulnerability Detail
The vulnerability in blk-iolatency arises from a flaw introduced in version v5.0 of the Linux Kernel by commit 8c772a9bfc7c07c76f4a58b58910452fbb20843b. It affects the inflight count tracking mechanism, causing imbalances and potential hangs when the device associated with blk-iolatency is offline. An attacker could exploit this vulnerability to disrupt I/O operations, leading to system instability or denial of service. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, a vulnerability has been identified in the Kernel package's blk-iolatency module, which can lead to imbalances in the inflight count and cause I/O hangs when the associated device is offline. It is recommended to update the Linux Kernel package to version v5.18.3 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel package is a critical component of the Linux operating system, responsible for managing core functionality and providing interfaces for hardware, software, and user applications.
blk-iolatency is a module within the Kernel package that controls the I/O latency of block devices. It allows administrators to set limits on the maximum latency for I/O operations, ensuring optimal performance.
This vulnerability can lead to imbalances in the inflight count and cause I/O hangs when the device associated with blk-iolatency is offline. It can result in system instability or denial of service.
No, the impact and attack plausibility of this vulnerability have not been proven yet. Further analysis and testing are required to determine the full extent of its consequences.
To fix this vulnerability, update the Linux Kernel package to version v5.18.3 or later, which includes the necessary fix for the inflight count imbalances and potential IO hangs on device offline.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
