UAF Issue in psi Trigger in Linux Kernel
Summary
GSD-2022-1000608: psi: Fix uaf issue when psi trigger is destroyed while being polled. Affects Kernel versions >= 0e94682b73bfa6c44c98af7a26771c9c08c055d5, < 991ced6a3a926e58df1f446819b9f2790e1c0daa. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system. It provides essential functionality and interfaces for various hardware devices, software components, and system services. The psi trigger is a feature in the Linux Kernel that allows monitoring of system pressure metrics such as CPU, memory, and IO. It provides insights into system resource utilization and helps in making resource management decisions. However, a use-after-free (UAF) vulnerability has been identified in the psi trigger when it is destroyed while being polled.
Vulnerability Detail
The UAF vulnerability in the psi trigger occurs when the trigger is destroyed while being polled. This can lead to a situation where the trigger object is freed from memory, but the polling code still references it. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service (DoS) condition. The impact and attack plausibility of this vulnerability have not been proven yet. The vulnerability was introduced in Linux Kernel version v5.2 and has been fixed in version v5.16.5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The UAF issue in the psi trigger of the Linux Kernel has the potential to be exploited by attackers to execute arbitrary code or cause a DoS condition. It is recommended to update the Linux Kernel to version v5.16.5 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The psi trigger is a feature in the Linux Kernel that allows monitoring of system pressure metrics such as CPU, memory, and IO. It provides insights into system resource utilization and helps in making resource management decisions.
A use-after-free (UAF) vulnerability occurs when a program or system continues to use a memory object after it has been freed. This can lead to unpredictable behavior and potential security issues.
The impact of this vulnerability could potentially allow an attacker to execute arbitrary code or cause a denial-of-service (DoS) condition. However, the actual impact and attack plausibility have not been proven yet.
This vulnerability was introduced in Linux Kernel version v5.2.
Yes, this vulnerability has been fixed in Linux Kernel version v5.16.5.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
