Vulnerability in Kernel: dax: make sure inodes are flushed before destroy cache
Summary
GSD-2022-1001224: dax: make sure inodes are flushed before destroy cache. Affects Kernel versions >= 7b6be8444e0f0dd675b54d059793423d3c9b4c03, < b786abe7c67c6ef71410c8e23292b3091d616ad1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages communication between hardware and software. It provides essential functions and services for the system's operation. The vulnerability in question affects the Kernel's dax module, which is responsible for managing Direct Access (DAX) memory mappings. DAX allows applications to directly access persistent memory, bypassing the file system cache. This vulnerability specifically pertains to the destruction of the cache without properly flushing inodes, which can lead to data corruption or loss.
Vulnerability Detail
The vulnerability arises from a failure to ensure that inodes are flushed before destroying the cache in the dax module of the Kernel. When the cache is destroyed without flushing the inodes, data inconsistencies can occur, potentially resulting in data corruption or loss. This vulnerability was introduced in version v4.12 of the Linux Kernel and has been fixed in version v5.17.2. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in the Kernel's dax module, which fails to flush inodes before destroying the cache, can lead to data corruption or loss. It is crucial to update the Linux Kernel to version v5.17.2 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can result in data corruption or loss due to inconsistencies in the cache and inodes.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will alert you in real-time if the vulnerability is present.
At the time of this report, there is no known exploit for this vulnerability. However, it is important to apply the recommended fix to mitigate any potential risks.
The remote exploitability of this vulnerability has not been determined yet. It is advisable to update the Kernel to the fixed version to ensure system security.
The recommended solution is to update the Linux Kernel to the fixed version. There are no alternative workarounds or patches mentioned for this specific vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
