Vulnerability in Linux Kernel: block: don't delete queue kobject before its children
Summary
GSD-2022-1001583: block: don't delete queue kobject before its children. Affects Kernel versions >= 2c2086afc2b8b974fac32cb028e73dc27bfae442, < cf0cb8686e55d9c022944bc6ba9e19e832889e83. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux Kernel is a widely used open-source operating system kernel that serves as the foundation for various Linux distributions. It provides essential functionality for managing hardware resources, scheduling tasks, and facilitating communication between software components. The block subsystem within the Linux Kernel is responsible for handling block devices such as hard drives and SSDs. It includes a queue kobject, which represents a queue of I/O requests. This vulnerability specifically affects the deletion of the queue kobject before its children, potentially leading to undefined behavior and security issues.
Vulnerability Detail
The vulnerability arises from the improper deletion of the queue kobject in the block subsystem of the Linux Kernel. When the queue kobject is deleted before its children, it can result in various problems, including use-after-free vulnerabilities and incorrect memory management. An attacker may be able to exploit this vulnerability to execute arbitrary code, escalate privileges, or cause a denial-of-service condition. The impact and attack plausibility of this vulnerability have not been fully proven. It is important to note that this vulnerability has been fixed in Linux Kernel version v5.16.19.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply the patch provided in the commit cf0cb8686e55d9c022944bc6ba9e19e832889e83. The patch modifies the code to ensure that the queue kobject is not deleted before its children. Here is an example of the modified code:
// Original code
...
void delete_queue_kobject(struct queue_kobject *qkobj) {
kobject_put(&qkobj->kobj);
}
...
// Modified code
...
void delete_queue_kobject(struct queue_kobject *qkobj) {
kobject_put(&qkobj->children_kobj);
kobject_put(&qkobj->kobj);
}
By applying this patch, the vulnerability can be mitigated until the Linux Kernel is updated to a fixed version.
Conclusion
In conclusion, the vulnerability in the Linux Kernel's block subsystem regarding the deletion of the queue kobject before its children can lead to various security issues. It is crucial to update the Linux Kernel to version v5.16.19 or later to mitigate this vulnerability. Regularly updating the Linux Kernel is essential to ensure the application of the latest security patches and bug fixes. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Linux Kernel is an open-source operating system kernel that serves as the foundation for various Linux distributions. It provides essential functionality for managing hardware resources, scheduling tasks, and facilitating communication between software components.
The block subsystem in the Linux Kernel is responsible for handling block devices such as hard drives and SSDs. It includes a queue kobject, which represents a queue of I/O requests.
A queue kobject is a data structure in the block subsystem of the Linux Kernel that represents a queue of I/O requests. It is used for managing and processing I/O operations on block devices.
This vulnerability can potentially allow an attacker to execute arbitrary code, escalate privileges, or cause a denial-of-service condition. However, the actual impact and attack plausibility have not been fully proven.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.16.19 or later. This can be done by obtaining the latest version of the Linux Kernel source code from the official repository and compiling it according to the provided instructions.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
