Use-after-free vulnerability in dm_cleanup_zoned_dev() in Linux Kernel
Summary
GSD-2022-1001300: dm: fix use-after-free in dm_cleanup_zoned_dev(). Affects Kernel versions >= bb37d77239af25cde59693dbe3fac04dd17d7b29, < 43a043aed964659bc69ef81f266912b73c80d837. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system. It provides essential functionality, such as managing system resources, device drivers, and security features. The dm (device mapper) subsystem in the Linux Kernel is responsible for providing an abstraction layer for block devices, allowing for advanced storage management features. The dm_cleanup_zoned_dev() function is part of the dm subsystem and is used to clean up resources associated with a zoned block device. A zoned block device is a type of storage device that divides its storage space into zones, each with specific characteristics. This vulnerability affects the dm_cleanup_zoned_dev() function and can lead to a use-after-free condition.
Vulnerability Detail
The use-after-free vulnerability in dm_cleanup_zoned_dev() occurs when the function improperly handles the cleanup of resources associated with a zoned block device. This can result in a situation where a pointer to freed memory is still accessible, leading to potential memory corruption or arbitrary code execution. An attacker who can trigger this vulnerability may be able to exploit it to gain elevated privileges, crash the system, or execute malicious code. The vulnerability was introduced in Linux Kernel version 5.14 and is fixed in version 5.17.2.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official fix by updating the Linux Kernel.
Conclusion
The use-after-free vulnerability in dm_cleanup_zoned_dev() in the Linux Kernel can have serious security implications, including memory corruption, arbitrary code execution, system crashes, and privilege escalation. It is crucial to update the Linux Kernel to version 5.17.2 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The use-after-free vulnerability in dm_cleanup_zoned_dev() can potentially lead to memory corruption, arbitrary code execution, system crashes, or privilege escalation.
An attacker who can trigger the vulnerability may be able to execute arbitrary code, gain elevated privileges, or crash the system.
The vulnerability was introduced in Linux Kernel version 5.14 and affects all versions up to and including version 5.17.1.
Yes, the vulnerability is fixed in Linux Kernel version 5.17.2.
The recommended mitigation is to update the Linux Kernel to version 5.17.2 or later.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
