Vulnerability in dma-buf/sync_file in Kernel
Summary
GSD-2021-1001381: dma-buf/sync_file: Don't leak fences on merge failure. Affects Kernel versions >= a02b9dc90d844cc7df7b63264e7920cc425052d9, < e0355a0ad31a1d677b2a4514206de4902bd550e8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Kernel is a critical component of the Linux operating system that provides core functionalities and manages system resources. It acts as an interface between the hardware and software layers, facilitating communication and coordination between various components. The dma-buf/sync_file subsystem within the Kernel is responsible for handling synchronization between different devices and processes using Direct Memory Access (DMA) buffers. This subsystem allows for efficient sharing of memory resources across different components of the system.
Vulnerability Detail
The vulnerability identified in dma-buf/sync_file can lead to the leakage of fences on merge failure. When merging synchronization files, if the process encounters an error, it fails to clean up the associated fences properly. This can result in the leakage of sensitive information or resources, potentially leading to privilege escalation or denial of service attacks. The vulnerability was introduced in version v4.9 of the Linux Kernel and was fixed in version v4.19.199.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can implement proper error handling and resource cleanup in their applications or scripts that utilize the dma-buf/sync_file subsystem. By explicitly releasing and destroying fences in case of merge failures, the risk of leakage can be mitigated. Here is an example of how to handle merge failures and clean up fences in a C program:
#include <linux/dma-buf.h>
struct dma_fence *fence;
/* Perform synchronization and merge operation */
int ret = dma_fence_merge(fence1, fence2);
if (ret) {
/* Handle merge failure */
dma_fence_put(fence1);
dma_fence_put(fence2);
}
Conclusion
The vulnerability in dma-buf/sync_file can lead to the leakage of fences on merge failure, potentially resulting in the exposure of sensitive information or resources. It is crucial to update the Linux Kernel to version v4.19.199 or later to mitigate this vulnerability. Implementing proper error handling and resource cleanup in applications can also serve as a workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The dma-buf/sync_file subsystem in the Kernel enables synchronization and sharing of Direct Memory Access (DMA) buffers between different devices and processes. It provides a mechanism for efficient memory resource management and coordination.
The vulnerability in dma-buf/sync_file can result in the leakage of fences on merge failure. This can potentially lead to the exposure of sensitive information or resources, opening avenues for privilege escalation or denial of service attacks.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this specific issue.
Yes, a workaround for this vulnerability is to implement proper error handling and resource cleanup in applications or scripts that utilize the dma-buf/sync_file subsystem. By explicitly releasing and destroying fences in case of merge failures, the risk of leakage can be mitigated.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v4.19.199 or later. Obtain the latest stable version from the official Git repository and follow the installation instructions provided.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
