Potential Silent Data Corruption in drbd
Summary
GSD-2022-1001907: drbd: fix potential silent data corruption. Affects Kernel versions < 024c2a0db53a0f6f0f227ce6b88288e5b9e3f099. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The drbd package is a distributed replicated block device for Linux. It allows data replication between multiple servers, ensuring high availability and data integrity. The package is commonly used in clustered environments to provide shared storage. However, a potential vulnerability has been discovered in drbd that could lead to silent data corruption.
Vulnerability Detail
The vulnerability in drbd could result in silent data corruption. Although the impact and attack plausibility have not been proven, it is crucial to address this issue to ensure data integrity. The vulnerability has been fixed in Linux Kernel version v5.15.33 by commit 024c2a0db53a0f6f0f227ce6b88288e5b9e3f099.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Updating the Linux Kernel to the fixed version is the recommended solution.
Conclusion
The potential silent data corruption vulnerability in drbd can be addressed by updating the Linux Kernel to version v5.15.33 or later. It is crucial to ensure data integrity in clustered environments that rely on drbd for shared storage. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
drbd is a distributed replicated block device for Linux that enables data replication between multiple servers.
Silent data corruption refers to the situation where data is modified or corrupted without any indication or error message. This can lead to data integrity issues and potential data loss.
You can use Vulert's playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will provide real-time monitoring and alerts for open-source vulnerabilities.
Yes, the vulnerability has been fixed in Linux Kernel version v5.15.33. It is recommended to update the kernel to this version or later.
There is no specific workaround mentioned for this vulnerability. Updating the Linux Kernel to the fixed version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
