Vulnerability in dm era: commit metadata in postsuspend after worker stops
Summary
GSD-2022-1004832: dm era: commit metadata in postsuspend after worker stops. Affects Kernel versions >= eec40579d84873dfb7021eb24c50360f073237c5, < 0d3124ec378037711f71e9ebb70c0ab98e420eb3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dm era package is a component of the Linux Kernel ecosystem. It provides support for the era target in the device-mapper framework. The era target allows for efficient and space-saving snapshots of block devices. This vulnerability affects versions of the Linux Kernel from v3.15 to v4.19.250.
Vulnerability Detail
The vulnerability in dm era allows an attacker to manipulate commit metadata in postsuspend after the worker stops. Although the impact and attack plausibility have not been proven, this vulnerability has the potential to compromise the integrity and security of the affected system. It was introduced in version v3.15 by commit eec40579d84873dfb7021eb24c50360f073237c5 and fixed in version v4.19.250 by commit 0d3124ec378037711f71e9ebb70c0ab98e420eb3.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
In conclusion, the dm era package in the Linux Kernel is vulnerable to a commit metadata manipulation issue. It is recommended to update to version v4.19.250 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven, but it has the potential to compromise the integrity and security of the affected system.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it in real-time.
Yes, a patch is available in the Linux Kernel version v4.19.250. It is recommended to update to this version or later to fix the vulnerability.
The remote exploitability of this vulnerability has not been determined yet.
This vulnerability was discovered by an automated ID intended to aid in the discovery of potential security vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
