Vulnerability in dm package: Fix mempool NULL pointer race when completing IO
Summary
GSD-2021-1002147: dm: fix mempool NULL pointer race when completing IO. Affects Kernel versions < d208b89401e073de986dc891037c5a668f5d5d95. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dm package is a component of the Linux Kernel, which is responsible for device-mapper functionality. Device-mapper is a framework that provides a generic way to create virtual block devices, such as encrypted volumes, RAID arrays, and snapshot devices. It is widely used in Linux distributions and provides essential functionality for various storage-related tasks. However, a vulnerability has been discovered in the dm package that can lead to a NULL pointer race condition when completing IO operations.
Vulnerability Detail
The vulnerability in the dm package arises due to a race condition involving a mempool and a NULL pointer. When completing IO operations, there is a possibility of a race condition occurring, where the mempool is accessed before it is properly initialized, resulting in a NULL pointer dereference. This vulnerability could potentially be exploited by an attacker to cause a denial-of-service (DoS) condition or execute arbitrary code with kernel privileges. It is important to note that the impact and attack plausibility of this vulnerability have not yet been proven.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in the dm package, which could lead to a NULL pointer race condition when completing IO operations, has been addressed in the Linux Kernel version v5.15. It is crucial to update the kernel to the fixed version to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The dm package is a component of the Linux Kernel that provides device-mapper functionality, allowing the creation of virtual block devices.
A NULL pointer race condition occurs when multiple threads or processes access a NULL pointer concurrently, leading to unpredictable behavior or crashes.
This vulnerability could potentially be exploited by an attacker to cause a denial-of-service (DoS) condition or execute arbitrary code with kernel privileges.
No, the impact and attack plausibility of this vulnerability have not yet been proven.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.15 or later.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
