Vulnerability in Kernel Package: blk-cgroup UAF
Summary
GSD-2021-1001662: blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd. Affects Kernel versions < f58d305887ad7b24986d58e881f6806bb81b2bdf. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a vital component of the Linux operating system, responsible for managing the system's core functionality. It provides essential services such as process management, memory management, and device drivers. The blk-cgroup module within the Kernel package is responsible for managing block I/O access control and accounting. It allows administrators to allocate and limit I/O resources for specific processes or groups of processes. However, a vulnerability has been discovered in the blk-cgroup module that could lead to a use-after-free (UAF) condition.
Vulnerability Detail
The identified vulnerability in the blk-cgroup module arises from a failure to acquire the blkcg lock before destroying the block group percpu data (blkg pd). This UAF vulnerability could potentially be exploited by an attacker to gain unauthorized access or execute arbitrary code within the system. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in the Linux Kernel version v5.10.70 by commit f58d305887ad7b24986d58e881f6806bb81b2bdf.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability. It is crucial to update the Kernel package to the fixed version as soon as possible.
Conclusion
The identified vulnerability in the Kernel package's blk-cgroup module could potentially lead to unauthorized access or code execution. It is crucial to update the Kernel package to the fixed version to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel package is a fundamental component of the Linux operating system, responsible for managing core system functionality.
The blk-cgroup module is a part of the Kernel package that handles block I/O access control and accounting.
A use-after-free vulnerability occurs when a program continues to use a memory area after it has been freed, leading to potential security issues.
If successfully exploited, this vulnerability could allow an attacker to gain unauthorized access or execute arbitrary code within the system.
Yes, this vulnerability has been fixed in the Linux Kernel version v5.10.70 by commit f58d305887ad7b24986d58e881f6806bb81b2bdf.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
