Race Condition Vulnerability in nbd Module of Linux Kernel
Summary
GSD-2022-1003668: nbd: fix race between nbd_alloc_config() and module removal. Affects Kernel versions < 8a7da4ced236ce6637fe70f14ca18e718d4bf9e9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The nbd module is a part of the Linux Kernel and is responsible for handling network block devices. It allows users to access remote block devices over a network. The module provides a client-side implementation of the Network Block Device (NBD) protocol. The NBD protocol allows a client to access block devices exported by an NBD server. The nbd module is widely used in various Linux distributions and is an integral part of the Linux Kernel.
Vulnerability Detail
The nbd module in the Linux Kernel is vulnerable to a race condition between the nbd_alloc_config() function and module removal. This vulnerability can be exploited by an attacker to cause a denial-of-service (DoS) condition or potentially execute arbitrary code with kernel privileges. The race condition occurs when the nbd_alloc_config() function is called concurrently with the removal of the nbd module. This can lead to memory corruption or use-after-free vulnerabilities, which can be leveraged by an attacker to gain unauthorized access or disrupt the normal operation of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the nbd module if it is not required for their system. This can be done by blacklisting the module or removing it from the kernel configuration. However, this workaround may not be feasible in all cases, especially if the nbd module is essential for the system's functionality.
Conclusion
The race condition vulnerability in the nbd module of the Linux Kernel can lead to a denial-of-service (DoS) condition or potential execution of arbitrary code with kernel privileges. It is recommended to update the kernel to version v5.4.198 or later to mitigate this vulnerability. Users can also disable the nbd module as a temporary workaround if it is not required for their system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can lead to a denial-of-service (DoS) condition or potential execution of arbitrary code with kernel privileges. An attacker can exploit the race condition to gain unauthorized access or disrupt the normal operation of the system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just a manifest file like package-lock.json.
Yes, a patch for this vulnerability is available in the Linux Kernel version v5.4.198. It is recommended to update the kernel to the latest version to mitigate the vulnerability.
Yes, as a temporary workaround, you can disable the nbd module if it is not required for your system. This can be done by blacklisting the module or removing it from the kernel configuration.
At the time of this report, there are no known public exploits available for this vulnerability. However, it is important to apply the recommended patches and keep the system up to date to mitigate any potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
