dm raid: Fix accesses beyond end of raid member array
Summary
GSD-2022-1004731: dm raid: fix accesses beyond end of raid member array. Affects Kernel versions < 90de15357504c8097ab29769dc6852e16281e9e8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dm raid package is a component of the Linux Kernel that provides support for RAID (Redundant Array of Independent Disks) devices in the device-mapper framework. RAID allows multiple physical disks to be combined into a single logical unit for improved performance, redundancy, or both. The dm raid package manages these RAID devices and provides various features and configurations for them.
Vulnerability Detail
The vulnerability identified as GSD-2022-1004731 in the dm raid package involves accesses beyond the end of the raid member array. This vulnerability could potentially lead to memory corruption or other undefined behavior, which could be exploited by an attacker to gain unauthorized access, execute arbitrary code, or cause a denial of service. The vulnerability has been fixed in Linux Kernel version v5.4.204 by commit 90de15357504c8097ab29769dc6852e16281e9e8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The dm raid package in the Linux Kernel is vulnerable to accesses beyond the end of the raid member array. This vulnerability has been fixed in Linux Kernel version v5.4.204. It is crucial to update the kernel to the fixed version to mitigate the risk of potential exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
dm raid is a package in the Linux Kernel that manages RAID devices, allowing multiple physical disks to be combined into a single logical unit.
The vulnerability could potentially lead to memory corruption or other undefined behavior, which could be exploited by an attacker to gain unauthorized access, execute arbitrary code, or cause a denial of service.
Yes, the vulnerability has been fixed in Linux Kernel version v5.4.204 by commit 90de15357504c8097ab29769dc6852e16281e9e8.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.4.204 or later.
No specific workaround has been mentioned for this vulnerability. It is recommended to update the Linux Kernel to the fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
