UAF Issue in psi Trigger in Linux Kernel
Summary
GSD-2022-1000150: psi: Fix uaf issue when psi trigger is destroyed while being polled. Affects Kernel versions >= 0e94682b73bfa6c44c98af7a26771c9c08c055d5, < 2fd752ed77ab9880da927257b73294f29a199f1a. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing an interface for applications to interact with the hardware. The psi trigger is a feature in the kernel that allows monitoring of system pressure metrics such as CPU, memory, and IO. It provides information about the system's ability to handle workload and can be used for resource management and performance tuning.
Vulnerability Detail
The vulnerability identified as GSD-2022-1000150 is an use-after-free (UAF) issue in the psi trigger of the Linux Kernel. When the psi trigger is destroyed while being polled, a reference to it may still exist in the polling code. This can lead to a use-after-free condition where the memory previously allocated for the psi trigger is accessed, potentially causing a crash or allowing an attacker to execute arbitrary code with kernel privileges. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The UAF issue in the psi trigger of the Linux Kernel can be fixed by updating to version v5.4.177 or later. It is important to regularly update the kernel to ensure the latest security patches are applied. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The psi trigger is a feature in the Linux Kernel that allows monitoring of system pressure metrics such as CPU, memory, and IO. It provides information about the system's ability to handle workload and can be used for resource management and performance tuning.
A use-after-free vulnerability occurs when a program continues to use a memory region after it has been freed. This can lead to memory corruption, crashes, or potential execution of arbitrary code.
The impact of this vulnerability is not yet proven. However, if successfully exploited, it could lead to a crash or allow an attacker to execute arbitrary code with kernel privileges.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.4.177 or later, where the UAF issue has been fixed.
No specific workaround has been mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
