Vulnerability in Kernel: blk-cgroup_bio_start() should use irq-safe operations on blkg->iostat_cpu

Background

The Kernel is a fundamental component of the Linux operating system that manages system resources and provides an interface for applications to interact with the hardware. It is responsible for tasks such as process management, memory management, and device drivers. The blk-cgroup module within the Kernel is used to implement block I/O resource management and accounting. It allows for control and monitoring of I/O operations on block devices. However, a vulnerability has been discovered in the blk-cgroup module that can lead to potential security risks.

Vulnerability Detail

The vulnerability in blk-cgroup_bio_start() arises from the use of non-irq-safe operations on the blkg->iostat_cpu variable. This can result in race conditions and data corruption when multiple processes or threads attempt to access and modify the variable simultaneously. An attacker could potentially exploit this vulnerability to gain unauthorized access, escalate privileges, or cause denial of service. The vulnerability was introduced in version v5.13 of the Linux Kernel and has been fixed in version v5.14.15.

Workaround

If updating the Kernel is not immediately feasible, a possible workaround is to apply the patch provided in the commit b1a34f86b41fd89441fa0e245b6b23627b0d73d3. The patch modifies the blk-cgroup_bio_start() function to use irq-safe operations on blkg->iostat_cpu. Here is an example of the modified code:

// Original code
void blk_cgroup_bio_start(struct request_queue *q, struct bio *bio)
{
    // Non-irq-safe operations on blkg->iostat_cpu
    ...
}

// Patched code
void blk_cgroup_bio_start(struct request_queue *q, struct bio *bio)
{
    // Modified code using irq-safe operations
    ...
}

Conclusion

The vulnerability in the Kernel's blk-cgroup module can pose significant security risks if left unaddressed. It is crucial to update the Kernel to version v5.14.15 or later, or apply the provided patch, to mitigate these risks. Regularly monitoring for open-source vulnerabilities using tools like Vulert can also help ensure the security of your system.

See every vulnerability recorded for Kernel →

FAQ