Vulnerability in blktrace: Use-After-Free when Accessing blk_trace after Removal by sysfs
Summary
GSD-2021-1001748: blktrace: Fix uaf in blk_trace access after removing by sysfs. Affects Kernel versions >= c71a896154119f4ca9e89d6078f5f63ad60ef199, < a5f8e86192612d0183047448d8bbe7918b3f1a26. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The blktrace package is a Linux kernel component that provides a framework for tracing block I/O requests. It allows users to monitor and analyze the I/O activity of block devices. The package includes utilities for capturing and analyzing I/O traces. However, a vulnerability has been discovered in blktrace that could lead to a use-after-free (UAF) issue when accessing blk_trace after it has been removed by sysfs.
Vulnerability Detail
The vulnerability in blktrace arises due to a use-after-free issue. When blk_trace is removed by sysfs, there is a possibility of accessing the freed memory, leading to potential crashes or arbitrary code execution. An attacker with local access to the system could exploit this vulnerability to gain elevated privileges or disrupt the normal functioning of the system. The vulnerability was introduced in version v2.6.30 of the Linux Kernel and has been fixed in version v5.14.9.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the blktrace functionality or remove the blk_trace module from the system if it is not required. This can be achieved by unloading the module or blacklisting it to prevent it from being loaded during system startup. However, it is strongly recommended to apply the official fix by updating the Linux Kernel to a patched version.
Conclusion
The vulnerability in blktrace can lead to a use-after-free issue when accessing blk_trace after it has been removed by sysfs. It is crucial to update the Linux Kernel to version v5.14.9 or later to mitigate this vulnerability. Users can also consider disabling or removing the blktrace functionality as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
blktrace is a Linux kernel component that provides a framework for tracing block I/O requests. It allows users to monitor and analyze the I/O activity of block devices.
A use-after-free vulnerability occurs when a program continues to use a memory region after it has been freed. This can lead to crashes, memory corruption, or arbitrary code execution.
An attacker with local access to the system can exploit this vulnerability by accessing the freed memory of blk_trace after it has been removed by sysfs. This can potentially allow the attacker to gain elevated privileges or disrupt the normal functioning of the system.
The vulnerability was introduced in version v2.6.30 of the Linux Kernel. All versions between v2.6.30 and v5.14.8 are affected. The issue has been fixed in version v5.14.9.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
