Vulnerability in Kernel Package: dax: make sure inodes are flushed before destroy cache
Summary
GSD-2022-1001854: dax: make sure inodes are flushed before destroy cache. Affects Kernel versions >= 7b6be8444e0f0dd675b54d059793423d3c9b4c03, < e2951eaa9398415ac054b7bd80b8163b6838ead4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a fundamental component of the Linux operating system, responsible for managing the system's core functionality. It provides essential services such as process management, memory management, and device drivers. The vulnerability in question affects the dax module within the Kernel package. The dax module allows for direct access to persistent memory, bypassing the file system cache. This vulnerability specifically pertains to the destruction of the dax cache without properly flushing inodes, which can lead to data corruption or loss.
Vulnerability Detail
The vulnerability arises from a failure to flush inodes before destroying the dax cache. When the cache is destroyed without flushing the inodes, any pending changes to the inodes may not be written to disk, resulting in potential data corruption or loss. An attacker could exploit this vulnerability to manipulate or destroy sensitive data stored in persistent memory. The vulnerability was introduced in version v4.12 of the Linux Kernel and has been fixed in version v5.15.33.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Kernel package is not immediately feasible, a potential workaround is to manually flush the inodes before destroying the dax cache. This can be achieved by executing the following code snippet:
// Manually flush inodes
flush_inodes();
// Destroy dax cache
destroy_dax_cache();
Conclusion
The vulnerability in the Kernel package's dax module, which allows for direct access to persistent memory, can result in data corruption or loss if inodes are not properly flushed before destroying the dax cache. It is crucial to update the Kernel package to version v5.15.33 or later to mitigate this risk. Alternatively, manually flushing the inodes before destroying the cache can serve as a temporary workaround. For additional support and guidance, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to data corruption or loss in systems utilizing the dax module of the Kernel package. Attackers could potentially manipulate or destroy sensitive data stored in persistent memory.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will alert you in real-time if the vulnerability is present.
Yes, this vulnerability has been fixed in version v5.15.33 of the Linux Kernel package. It is recommended to update to this version or later to mitigate the risk.
Yes, a potential workaround is to manually flush the inodes before destroying the dax cache. However, it is strongly advised to update the Kernel package to the fixed version instead of relying on workarounds.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
