Use After Free Vulnerability in dm btree remove
Summary
GSD-2021-1002624: dm btree remove: fix use after free in rebalance_children(). Affects Kernel versions < 66ea642af6fd4eacb5d0271a922130fcf8700424. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dm btree remove vulnerability affects the Kernel package in the Linux ecosystem. The Kernel is the core component of the Linux operating system, responsible for managing system resources and providing an interface for applications to interact with the hardware. The dm btree remove function is used in the Kernel's device mapper subsystem to remove entries from a B-tree data structure. This vulnerability specifically occurs in the rebalance_children() function of dm btree remove, leading to a use after free issue.
Vulnerability Detail
The use after free vulnerability in dm btree remove arises when the rebalance_children() function attempts to access memory that has already been freed. This can occur if a child node is removed during the rebalancing process, but its reference is still accessed afterwards. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial of service by manipulating the freed memory. The impact and attack plausibility of this vulnerability have not been proven. It is important to note that this vulnerability has been fixed in the Linux Kernel version v4.9.294 by commit 66ea642af6fd4eacb5d0271a922130fcf8700424.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The dm btree remove vulnerability in the Kernel package of the Linux ecosystem has been identified and fixed in version v4.9.294. It is crucial to update the Kernel to the fixed version to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The dm btree remove vulnerability is a use after free issue in the Linux Kernel's device mapper subsystem. It occurs in the rebalance_children() function of dm btree remove, allowing an attacker to exploit freed memory and potentially execute arbitrary code or cause a denial of service.
The impact of this vulnerability is not yet proven. However, if successfully exploited, it could lead to arbitrary code execution or denial of service.
To fix this vulnerability, update the Linux Kernel to version v4.9.294 or later by pulling the latest changes from the official Linux Kernel repository and recompiling the Kernel.
No specific workaround has been provided for this vulnerability. It is recommended to update the Kernel to the fixed version.
More information about this vulnerability can be found in the official Linux Kernel repository and the Cloud Security Alliance's GSD database.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
