Fix handling of offline queues in blk_mq_alloc_request_hctx()
Summary
GSD-2022-1004500: block: Fix handling of offline queues in blk_mq_alloc_request_hctx(). Affects Kernel versions >= 20e4d813931961fe26d26a1e98b3aba6ec00b130, < b5e65ef044d627effdc2599040b6d204e003f955. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The vulnerability affects the Kernel package in the Linux ecosystem. The Kernel is the core component of the Linux operating system, responsible for managing system resources and providing an interface for applications to interact with the hardware. The specific vulnerability lies in the handling of offline queues in the blk_mq_alloc_request_hctx() function.
Vulnerability Detail
The vulnerability in blk_mq_alloc_request_hctx() was introduced in version v4.16 of the Linux Kernel and fixed in version v5.15.49. It can potentially lead to security issues, although the actual impact and attack plausibility have not been proven. The vulnerability arises from incorrect handling of offline queues, which could be exploited by malicious actors to manipulate the system and potentially gain unauthorized access or cause denial of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in blk_mq_alloc_request_hctx() in the Kernel package has the potential to be exploited for unauthorized access or denial of service. It is recommended to update to version v5.15.49 or later of the Linux Kernel to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven, but it has the potential to be exploited for unauthorized access or denial of service.
You can use Vulert's playground at Vulert Scanner to check if your system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Yes, a fix is available in version v5.15.49 of the Linux Kernel. It is recommended to update to this version or later to mitigate the vulnerability.
The remote exploitability of this vulnerability has not been determined. However, it is advisable to apply the fix as a precautionary measure.
There are no known instances of this vulnerability being exploited at the moment.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
