UAF in blk_trace access after removing by sysfs in Kernel
Summary
UVI-2021-1001610: blktrace: Fix uaf in blk_trace access after removing by sysfs. Affects Kernel versions >= c71a896154119f4ca9e89d6078f5f63ad60ef199, < ebb8d26d93c3ec3c7576c52a8373a2309423c069. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that provides core functionalities and acts as an interface between the hardware and software layers. It manages system resources, facilitates communication between different components, and ensures the overall stability and security of the system. The blktrace module within the Kernel allows users to trace block I/O events and collect performance data for storage devices. However, a vulnerability has been identified in the blktrace module that can lead to a use-after-free (UAF) issue when accessing blk_trace after it has been removed by sysfs.
Vulnerability Detail
The UAF vulnerability in blktrace arises when accessing blk_trace after it has been removed by sysfs. This can potentially result in a variety of security issues, including crashes, privilege escalation, or the execution of arbitrary code by an attacker. The vulnerability was introduced in version v2.6.30 of the Linux Kernel and has been fixed in version v5.4.150 by commit ebb8d26d93c3ec3c7576c52a8373a2309423c069.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The UAF vulnerability in blktrace, which allows for access to blk_trace after it has been removed by sysfs, poses a significant security risk. To address this vulnerability, it is essential to update the Linux Kernel to version v5.4.150 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can potentially lead to crashes, privilege escalation, or the execution of arbitrary code by an attacker.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time alerts for open-source vulnerabilities, including this one.
No specific workaround has been provided for this vulnerability. It is recommended to update the Linux Kernel to the fixed version.
Yes, this vulnerability can be exploited remotely if an attacker can gain access to the affected system.
There are no known instances of this vulnerability being exploited in the wild at the time of writing. However, it is crucial to apply the necessary updates to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
