Vulnerability in Kernel: Fix the maximum minor value is blk_alloc_ext_minor()
Summary
GSD-2022-1001428: block: Fix the maximum minor value is blk_alloc_ext_minor(). Affects Kernel versions >= 22ae8ce8b89241c94ac00c237752c0ffa37ba5ae, < 0f8cf8f5ccbad25ed6828875b222dbab29d5c272. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages communication between hardware and software. It provides essential functions and services for the system's operation. This vulnerability affects the Kernel and specifically impacts the blk_alloc_ext_minor() function. This function is responsible for allocating minor numbers for block devices. The vulnerability allows for the allocation of an excessively large minor value, which can lead to various security issues.
Vulnerability Detail
The vulnerability arises from a flaw in the blk_alloc_ext_minor() function within the Kernel. By exploiting this flaw, an attacker could allocate a minor number that exceeds the maximum allowed value. This can result in several potential security risks, such as privilege escalation, denial of service, or information disclosure. The vulnerability was introduced in version v5.11 of the Linux Kernel and has been fixed in version v5.16.19.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by updating the Linux Kernel to the recommended version.
Conclusion
In conclusion, the vulnerability in the Kernel's blk_alloc_ext_minor() function allows for the allocation of an excessively large minor value, leading to potential security risks. To mitigate these risks, it is crucial to update the Linux Kernel to version v5.16.19 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can potentially lead to privilege escalation, denial of service, or information disclosure.
You can use Vulert's playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time alerts for open-source vulnerabilities.
No, there is no known workaround for this vulnerability. It is crucial to update the Linux Kernel to the recommended version.
The vulnerability was introduced in version v5.11 of the Linux Kernel. All versions between v5.11 and v5.16.18 are affected.
You can find more information about this vulnerability in the Open Source Vulnerability Database (OSVDB) under ID GSD-2022-1001428.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
