Vulnerability in Kernel: nbd: call genl_unregister_family() first in nbd_cleanup()
Summary
GSD-2022-1002882: nbd: call genl_unregister_family() first in nbd_cleanup(). Affects Kernel versions < 6f505bbb8063fd3a238a4239d2d8c165e5279f6f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionality and acts as an interface between hardware and software. It manages system resources, facilitates communication between different components, and enables the execution of user programs. The nbd (Network Block Device) is a kernel module that allows remote storage devices to be accessed over a network. It provides a mechanism for exporting and mounting remote block devices as if they were local. The nbd_cleanup() function is responsible for cleaning up resources used by the nbd module. However, there is a vulnerability in the cleanup process that can lead to potential security issues.
Vulnerability Detail
The vulnerability in the nbd module arises from the improper order of operations in the nbd_cleanup() function. Specifically, the genl_unregister_family() function, which unregisters the nbd generic netlink family, is not called before other cleanup operations. This can result in the nbd module being unloaded while the generic netlink family is still registered, leading to potential use-after-free and other memory-related issues. An attacker with local access to the system may be able to exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition. It is important to note that the impact and attack plausibility of this vulnerability have not been proven.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the nbd module in the Linux Kernel is vulnerable to a security issue related to the improper order of operations in the nbd_cleanup() function. This vulnerability can potentially be exploited by an attacker with local access to the system. To mitigate this vulnerability, it is recommended to update the Linux Kernel to version v5.17.15 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can vary depending on the attacker's capabilities and the system's configuration. In the worst case, an attacker with local access to the system may be able to execute arbitrary code or cause a denial-of-service condition.
No, this vulnerability requires local access to the system to be exploited.
There are no known instances of this vulnerability being exploited in the wild. However, it is still important to apply the necessary updates to mitigate the risk.
No, a CVSS score has not been assigned to this vulnerability at the time of this report.
For more details about this vulnerability, including the specific commit that fixes it, please refer to the references link provided in the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
