Vulnerability in Kernel: mm, thp: bail out early in collapse_file for writeback page
Summary
GSD-2021-1002060: mm, thp: bail out early in collapse_file for writeback page. Affects Kernel versions >= 99cb0dbd47a15d395bf3faa78dc122bc5efe3fc0, < 69a7fa5cb0de06c8956b040f19a7248c8c8308ca. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages system resources and facilitates communication between hardware and software. It provides essential functions for memory management, process scheduling, device drivers, and more. This vulnerability specifically affects the mm (memory management) subsystem and the transparent huge pages (thp) feature. Transparent huge pages allow for efficient memory allocation and management in large memory workloads. However, a flaw in the collapse_file function can lead to issues with writeback pages, potentially resulting in security vulnerabilities.
Vulnerability Detail
The vulnerability arises from a flaw in the collapse_file function within the mm subsystem of the Kernel. When collapsing a file, which involves merging multiple pages into a single page, the function fails to handle writeback pages correctly. This can lead to various security issues, although the exact impact and attack vectors have not been proven. Attackers may potentially exploit this vulnerability to gain unauthorized access, escalate privileges, or cause denial-of-service conditions. The vulnerability was introduced in Linux Kernel version 5.4 and has been fixed in version 5.10.77.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround available for this vulnerability. However, users can mitigate the risk by ensuring they have the latest Kernel version installed and keeping their systems up to date with security patches.
Conclusion
This vulnerability in the Kernel's mm subsystem and thp feature could potentially lead to security issues if left unaddressed. It is crucial to update the Linux Kernel to version 5.10.77 or later to mitigate the risk. Regularly applying security patches and keeping systems up to date is essential for maintaining a secure environment. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can vary depending on the specific system and usage scenario. It could potentially allow attackers to gain unauthorized access, escalate privileges, or cause denial-of-service conditions.
You can use tools like Vulert (https://vulert.com) to check if your system is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software.
At the time of this report, there is no known exploit for this vulnerability. However, it is important to apply the recommended updates and security patches to mitigate the risk.
No, only Linux Kernel versions starting from 5.4 up to 5.10.76 are affected. The vulnerability has been fixed in version 5.10.77 and later.
For more details about this vulnerability, you can refer to the source link provided in the database_specific section of this report.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
