Vulnerability in Kernel: sysrq: do not omit current cpu when showing backtrace of all active CPUs
Summary
GSD-2022-1002898: sysrq: do not omit current cpu when showing backtrace of all active CPUs. Affects Kernel versions < 5aee61b029b88c030f9415fde69b3805cda46944. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that acts as a bridge between the hardware and software layers. It provides essential functionalities such as process management, memory management, and device drivers. The vulnerability in question affects the Kernel's sysrq feature, which allows users to send various commands to the Kernel for debugging and troubleshooting purposes. This vulnerability specifically pertains to the omission of the current CPU when displaying the backtrace of all active CPUs.
Vulnerability Detail
The sysrq vulnerability in the Kernel results in the omission of the current CPU when displaying the backtrace of all active CPUs. This can potentially lead to incorrect or incomplete information being presented during debugging sessions. While the impact and attack plausibility have not been proven, it is crucial to address this vulnerability to ensure accurate and reliable debugging information. The vulnerability has been fixed in Linux Kernel version v5.17.15 by commit 5aee61b029b88c030f9415fde69b3805cda46944.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in the Kernel's sysrq feature, which omits the current CPU when displaying the backtrace of all active CPUs, has been identified and fixed in Linux Kernel version v5.17.15. To ensure accurate debugging information, it is recommended to update the Kernel to the latest version. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is the potential display of incorrect or incomplete information during debugging sessions.
You can use tools like Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert Playground allows you to analyze your manifest file, such as package-lock.json, and provides real-time alerts for open-source vulnerabilities.
The actual attack plausibility of this vulnerability has not been proven. However, it is important to address it to ensure accurate debugging information.
The recommended mitigation is to update the Linux Kernel to version v5.17.15 or later.
You can refer to the vulnerability details in the GSD database: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1002xxx/GSD-2022-1002898.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
