Vulnerability in Kernel: mm,hwpoison: unmap poisoned page before invalidation
Summary
GSD-2022-1001609: mm,hwpoison: unmap poisoned page before invalidation. Affects Kernel versions >= d66a7ce91383e1910fd6bcae038a27771d5630f0, < 46f3292a16b09bbd1b4541a9b9e7888945f89c04. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages system resources and facilitates communication between hardware and software. It provides essential functionalities such as memory management, process scheduling, and device drivers. The vulnerability in question affects the Kernel's handling of poisoned pages in the mm,hwpoison module. When a page is marked as poisoned, it should be unmapped before invalidation to prevent potential security risks.
Vulnerability Detail
The vulnerability arises from a failure to unmap poisoned pages before invalidation in the mm,hwpoison module of the Kernel. This oversight could potentially be exploited by attackers to gain unauthorized access or execute arbitrary code. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in Linux Kernel version v5.16.19 by commit 46f3292a16b09bbd1b4541a9b9e7888945f89c04. However, it was introduced in version v5.16.19 by commit d66a7ce91383e1910fd6bcae038a27771d5630f0.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in Kernel's mm,hwpoison module, which involves the failure to unmap poisoned pages before invalidation, could potentially lead to unauthorized access or arbitrary code execution. It is crucial to update the Linux Kernel to version v5.16.19 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven, but it could potentially allow attackers to gain unauthorized access or execute arbitrary code.
You can use Vulert's playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, this vulnerability has been fixed in Linux Kernel version v5.16.19 by commit 46f3292a16b09bbd1b4541a9b9e7888945f89c04.
If your system is affected, it is recommended to update the Linux Kernel to version v5.16.19 or later. Follow the official update process provided by your Linux distribution to ensure that you have the necessary patches and updates.
For more details about this vulnerability, you can refer to the source link provided in the Open Source Vulnerability format.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
