Memory Writeback Wait Issue in Linux Kernel
Summary
GSD-2021-1000912: mm/memory-failure: make sure wait for page writeback in memory_failure. Affects Kernel versions >= 0bc1f8b0682caa39f45ce1e0228ebf43acb46111, < 566345aaabac853aa866f53a219c4b02a6beb527. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing an interface for applications to interact with the hardware. It is widely used in various devices, including servers, desktops, and embedded systems. The memory-failure subsystem in the Linux Kernel handles memory errors and failures, ensuring system stability and reliability. However, a vulnerability has been discovered in this subsystem that could lead to potential security risks.
Vulnerability Detail
The vulnerability in the memory-failure subsystem of the Linux Kernel allows an attacker to exploit a race condition during memory failures. When a memory error occurs, the kernel triggers the memory_failure() function to handle the error. However, the function does not wait for the page writeback to complete before proceeding, potentially leaving sensitive data exposed. This vulnerability could be leveraged by an attacker to read or modify data that should be protected, leading to information disclosure or privilege escalation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the memory-failure subsystem by modifying the kernel configuration. However, this may impact the system's ability to handle memory errors properly. It is strongly recommended to apply the official fix by updating the kernel to the latest version.
Conclusion
The memory writeback wait issue in the Linux Kernel's memory-failure subsystem poses a potential security risk, allowing attackers to read or modify sensitive data. To mitigate this vulnerability, it is recommended to update the kernel to version v5.4.128 or later. Users can obtain the updated kernel from the official Linux Kernel repository. It is important to address this issue promptly to ensure the security and integrity of the system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability could allow an attacker to read or modify sensitive data, potentially leading to information disclosure or privilege escalation.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze and alert you if the vulnerability is present.
At the time of this report, there are no known public exploits targeting this vulnerability. However, it is important to apply the fix as soon as possible to prevent potential attacks.
No, this vulnerability requires local access to the system to exploit. However, it is still crucial to address the issue to protect against potential insider threats or local attackers.
For more details about this vulnerability, including technical specifics and the fix implementation, please refer to the source link provided in the database_specific section of this report.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
