Vulnerability in Kernel package: scsi: target: tcmu: Avoid holding XArray lock when calling lock_page
Summary
GSD-2022-1003150: scsi: target: tcmu: Avoid holding XArray lock when calling lock_page. Affects Kernel versions >= 4c9466307c6f0528afea34da90fe19eb79714c12, < 12a94329c5f48f2293b50f74725180823744bf35. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Kernel package is a critical component of the Linux operating system. It provides the core functionality and interfaces for various hardware devices and software components to interact with the system. The scsi target subsystem within the Kernel is responsible for handling SCSI target devices. One of the components in this subsystem is tcmu, which stands for Target Core Mod User. Tcmu allows users to create virtual SCSI devices that can be accessed by other systems over the network. This vulnerability specifically affects the tcmu component.
Vulnerability Detail
The vulnerability in tcmu arises from a flaw in the way it handles locking of pages. When calling the lock_page function, tcmu holds the XArray lock, which can lead to potential deadlocks or performance issues. An attacker could potentially exploit this vulnerability to cause a denial-of-service (DoS) condition or disrupt the normal operation of the system. It is important to note that the impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
In conclusion, the Kernel package, specifically the tcmu component, is vulnerable to a locking issue that can potentially lead to deadlocks, performance issues, or a denial-of-service (DoS) condition. It is crucial to update the Kernel to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability could range from potential deadlocks to performance issues, and in some cases, a denial-of-service (DoS) condition.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
No known exploit for this vulnerability has been reported at this time.
The recommended mitigation is to update the Kernel to the latest version that includes the fix for this vulnerability.
You can find more information about this vulnerability in the GSD-2022-1003150.json file available on the GitHub repository of the Cloud Security Alliance's GSD Database.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
