Vulnerability in dm era package: Commit Metadata in postsuspend after worker stops
Summary
GSD-2022-1004637: dm era: commit metadata in postsuspend after worker stops. Affects Kernel versions >= eec40579d84873dfb7021eb24c50360f073237c5, < 03d1874b8295384b232237418c07235753912b8f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dm era package is a component of the Linux Kernel ecosystem. It provides support for the era target in the device-mapper framework, allowing for efficient and reliable storage of data. The era target tracks the age of data blocks and enables efficient garbage collection. This vulnerability affects versions of the Linux Kernel starting from v3.15 and was fixed in v5.10.127. The vulnerability allows for the improper handling of commit metadata in postsuspend after the worker stops.
Vulnerability Detail
The vulnerability arises from a flaw in the dm era package, specifically in the handling of commit metadata during the postsuspend phase after the worker stops. An attacker could potentially exploit this vulnerability to manipulate commit metadata, leading to data corruption or unauthorized access. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in Linux Kernel version v5.10.127.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in the dm era package, which allowed for the improper handling of commit metadata in postsuspend after the worker stops, has been addressed in Linux Kernel version v5.10.127. It is recommended to update the Linux Kernel to this version or later to mitigate the vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The dm era package is a component of the Linux Kernel ecosystem that provides support for the era target in the device-mapper framework.
The era target in the device-mapper framework tracks the age of data blocks and enables efficient garbage collection.
The vulnerability could potentially lead to data corruption or unauthorized access.
Yes, this vulnerability has been fixed in Linux Kernel version v5.10.127.
To update the Linux Kernel, you can obtain the updated kernel source code from the official Linux Kernel repository and compile it according to the provided instructions.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
