Race Condition Vulnerability in rxrpc_exit_net() in Kernel
Summary
GSD-2022-1001977: rxrpc: fix a race in rxrpc_exit_net(). Affects Kernel versions >= ace45bec6d77bc061c3c3d8ad99e298ea9800c2b, < 08ff0e74fab517dbc44e11b8bc683dd4ecc65950. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionalities and manages system resources. It acts as an interface between the hardware and software layers, facilitating communication and coordination between various components. The rxrpc module is responsible for implementing the Reliable Datagram Protocol (RxRPC) in the Kernel, which enables reliable transmission of datagrams over unreliable networks. However, a race condition vulnerability has been identified in the rxrpc_exit_net() function, which can lead to potential security issues.
Vulnerability Detail
The race condition vulnerability in rxrpc_exit_net() allows for a race condition to occur during the exit process of the rxrpc module in the Kernel. This race condition can result in inconsistent or corrupted data, leading to various security risks. An attacker may be able to exploit this vulnerability to gain unauthorized access, escalate privileges, or cause a denial-of-service (DoS) condition. The vulnerability was introduced in version v4.17 of the Linux Kernel and has been fixed in version v5.10.111.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the rxrpc module if it is not required for their system. This can be achieved by blacklisting the module or removing it from the Kernel configuration. However, this workaround may impact the functionality of applications or services that rely on the rxrpc module.
Conclusion
The race condition vulnerability in rxrpc_exit_net() poses a potential security risk in the Linux Kernel. It is crucial to update the Kernel to version v5.10.111 or later to mitigate this vulnerability. Users can also use the Vulert Playground (https://vulert.com/scanner) to check if their system is affected and receive real-time alerts for open-source vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can potentially be exploited by attackers to gain unauthorized access, escalate privileges, or cause a denial-of-service (DoS) condition.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will provide real-time alerts for open-source vulnerabilities.
Yes, the vulnerability has been fixed in version v5.10.111 of the Linux Kernel. It is recommended to update to this version or a later one to mitigate the risk.
As a temporary workaround, you can disable the rxrpc module if it is not required for your system. However, this may impact the functionality of applications or services that rely on the module.
For more details about this vulnerability, you can refer to the vulnerability ID GSD-2022-1001977 in the GSD Database (https://github.com/cloudsecurityalliance/gsd-database).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
