Vulnerability in Kernel: block: null_blk: end timed out poll request
Summary
GSD-2022-1000976: block: null_blk: end timed out poll request. Affects Kernel versions >= 0a593fbbc245a85940ed34caa3aa1e4cb060c54b, < 407d09a22f3f685fd634aa5d05840c64b23bfebc. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages the communication between hardware and software. It provides essential services and functions to ensure the proper functioning of the system. The null_blk module is a virtual block device driver in the Kernel that allows users to create null block devices for testing and development purposes.
Vulnerability Detail
The vulnerability identified in the null_blk module of the Kernel allows an attacker to exploit a timeout issue in the 'end' function, leading to a denial-of-service (DoS) condition. By sending specially crafted requests, an attacker can cause the 'end' function to time out, resulting in a system hang or crash. This vulnerability was introduced in version v5.16 of the Linux Kernel and has been fixed in version v5.17.4.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.17.4 or later. This can be done by downloading the latest Kernel source code from the official repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/) and compiling it for your system. Alternatively, you can check if your system's package manager provides an update for the Kernel and install it accordingly.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can disable the null_blk module if it is not essential for your system. This can be done by blacklisting the module or removing it from the Kernel configuration. However, keep in mind that this workaround may impact any functionality or applications relying on the null_blk module.
Conclusion
In conclusion, the vulnerability in the null_blk module of the Kernel can lead to a denial-of-service (DoS) condition. It is recommended to update the Linux Kernel to version v5.17.4 or later to fix this vulnerability. If immediate updating is not possible, consider implementing the provided workaround and additional security measures. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can lead to a denial-of-service (DoS) condition, causing the system to hang or crash. It can disrupt normal system operations and potentially impact the availability of services running on the affected system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) to the playground, and it will analyze the dependencies and alert you if any vulnerabilities are found.
At the time of this report, there is no known public exploit for this vulnerability. However, it is always recommended to apply security patches and updates promptly to mitigate any potential risks.
No, this vulnerability requires an attacker to have local access to the system in order to exploit it. However, it is still important to address this vulnerability to prevent any potential local attacks or abuse.
The primary solution to mitigate this vulnerability is to update the Linux Kernel to the fixed version. However, if updating is not immediately feasible, you can consider implementing additional security measures such as restricting access to the affected system, monitoring for suspicious activity, and applying other relevant security patches and configurations.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.