Vulnerability in Kernel: tomoyo_domain_quota_is_ok() Check Exceeded Quota Early
Summary
GSD-2022-1000064: tomoyo: Check exceeded quota early in tomoyo_domain_quota_is_ok(). Affects Kernel versions < 3fe6a63b5dbdc0864f01d3171046af03d34ee747. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages system resources and facilitates communication between hardware and software. It provides essential functionalities such as process management, memory management, and device drivers. The tomoyo_domain_quota_is_ok() function is a part of the Kernel's Tomoyo security module, which implements Mandatory Access Control (MAC) policies. This function is responsible for checking if a domain has exceeded its quota. Quotas are used to limit the resources a domain can consume, ensuring fair resource allocation and preventing abuse.
Vulnerability Detail
The vulnerability identified as GSD-2022-1000064 in the Kernel's tomoyo_domain_quota_is_ok() function allows a domain to exceed its quota without proper early checking. This oversight can lead to resource exhaustion, denial of service, or privilege escalation attacks. An attacker could exploit this vulnerability by creating or manipulating domains to consume excessive resources, bypassing the intended quota restrictions. The impact of this vulnerability depends on the specific system configuration and the privileges assigned to the affected domains.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.15.13 or later. The fix for this vulnerability was implemented in commit 3fe6a63b5dbdc0864f01d3171046af03d34ee747. Updating the Kernel ensures that the tomoyo_domain_quota_is_ok() function performs the necessary early checks to prevent domains from exceeding their quotas.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply the patch provided in commit 3fe6a63b5dbdc0864f01d3171046af03d34ee747 manually. Here is an example of the patch:
--- a/security/tomoyo/domain.c
+++ b/security/tomoyo/domain.c
@@ -1231,6 +1231,9 @@ static bool tomoyo_domain_quota_is_ok(const struct tomoyo_domain_info *domain)
return false;
}
+ if (domain->quota_exceeded)
+ return false;
+
if (domain->profile->quota[0] <= domain->profile->quota[1])
return true;
Conclusion
In conclusion, the vulnerability in the Kernel's tomoyo_domain_quota_is_ok() function can allow domains to exceed their quotas without proper early checking. This can lead to resource exhaustion, denial of service, or privilege escalation attacks. It is crucial to update the Linux Kernel to version v5.15.13 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can vary depending on the system configuration and the privileges assigned to the affected domains. It could potentially lead to resource exhaustion, denial of service, or privilege escalation attacks.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Yes, a workaround is available. Users can manually apply the patch provided in commit 3fe6a63b5dbdc0864f01d3171046af03d34ee747. Please refer to the 'workaround' section for more details.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.15.13 or later. This update includes the necessary fix for the tomoyo_domain_quota_is_ok() function. Please refer to the 'how_to_fix' section for more details.
You can find more information about this vulnerability in the GSD-2022-1000064 JSON report available at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1000xxx/GSD-2022-1000064.json.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.