Memory Corruption in dm integrity Package
Summary
GSD-2022-1001640: dm integrity: fix memory corruption when tag_size is less than digest size. Affects Kernel versions < 6b4bf97587ef6c1927a78934b700204920655123. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dm integrity package is a component of the Linux Kernel that provides data integrity verification for block devices. It ensures that the data stored on these devices remains unchanged and has not been tampered with. The package achieves this by calculating a digest (hash) of the data and comparing it with a stored tag. If the digest and tag do not match, it indicates data corruption. However, a vulnerability has been discovered in the package that can lead to memory corruption when the tag size is smaller than the digest size.
Vulnerability Detail
The vulnerability in dm integrity arises when the tag size is less than the digest size. This can result in memory corruption, potentially leading to various security issues. An attacker could exploit this vulnerability to modify the tag, bypass data integrity checks, and potentially execute arbitrary code. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in the Linux Kernel version v5.15.35 by commit 6b4bf97587ef6c1927a78934b700204920655123.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, the dm integrity package in the Linux Kernel is vulnerable to memory corruption when the tag size is smaller than the digest size. This vulnerability can have serious security implications, but it has been fixed in the Linux Kernel version v5.15.35. It is crucial to update the kernel and configure the dm integrity package correctly to prevent memory corruption. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
dm integrity is a component of the Linux Kernel that provides data integrity verification for block devices.
The vulnerability can lead to memory corruption, potentially enabling attackers to modify tags, bypass data integrity checks, and execute arbitrary code.
Yes, this vulnerability has been fixed in the Linux Kernel version v5.15.35 by commit 6b4bf97587ef6c1927a78934b700204920655123.
To update the Linux Kernel, you can pull the latest updates from the official Linux Kernel repository using the command: $ git pull https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Ensure that the dm integrity package is configured to use a tag size that is equal to or greater than the digest size.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
