Double Free of blk_mq_tag_set in dev remove after table load fails in Kernel
Summary
UVI-2021-1000094: dm rq: fix double free of blk_mq_tag_set in dev remove after table load fails. Affects Kernel versions >= 1c357a1e86a4227a6b6059f2de118ae47659cebc, < 6086f957416a6e87236c06079fcaba7a3998aeca. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Kernel is a critical component of the Linux operating system that provides core functionalities and manages system resources. It acts as an interface between the hardware and software layers, facilitating communication and coordination between them. The Kernel is responsible for managing processes, memory, devices, and file systems. It plays a crucial role in ensuring the stability, security, and performance of the Linux system.
The vulnerability in question involves a double free of blk_mq_tag_set in dev remove after table load fails. This vulnerability can potentially lead to memory corruption and subsequent system instability or crashes. It was introduced in version v4.6 of the Linux Kernel and has been fixed in version v5.11.20.
Vulnerability Detail
The vulnerability arises from a double free issue in the Kernel's dm rq (request queue) module. When a table load fails, the code attempts to remove the device (dev) and free the associated blk_mq_tag_set. However, due to an error in the implementation, the blk_mq_tag_set is freed twice, leading to memory corruption.
An attacker who can trigger this vulnerability may be able to exploit the memory corruption to execute arbitrary code, escalate privileges, or cause denial-of-service conditions. The impact and attack plausibility of this vulnerability have not been proven yet.
To mitigate the risk, it is recommended to update the Linux Kernel to version v5.11.20 or later, where the vulnerability has been fixed.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The double free vulnerability in the Kernel's dm rq module can lead to memory corruption and potential exploitation by attackers. It is crucial to update the Linux Kernel to version v5.11.20 or later to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel is a critical component of the Linux operating system that provides core functionalities and manages system resources.
A double free vulnerability occurs when a program attempts to free a memory block that has already been freed. This can lead to memory corruption and subsequent system instability or crashes.
An attacker who can trigger this vulnerability may be able to exploit the memory corruption to execute arbitrary code, escalate privileges, or cause denial-of-service conditions.
No, the impact and attack plausibility of this vulnerability have not been proven yet.
To mitigate the risk, it is recommended to update the Linux Kernel to version v5.11.20 or later, where the vulnerability has been fixed.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
