Vulnerability in Kernel: mm/pages_alloc.c
Summary
GSD-2022-1002134: mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node. Affects Kernel versions >= 2a1e274acf0b1c192face19a4be7c12d4503eaaf, < 7188e7c96f39ae40b8f8d6a807d3f338fb1927ac. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a fundamental component of the Linux operating system that manages system resources and provides an interface for software to interact with hardware. It is responsible for memory management, process scheduling, device drivers, and other critical functions. The vulnerability in mm/pages_alloc.c affects the memory allocation mechanism of the Kernel, specifically related to the creation of ZONE_MOVABLE beyond the end of a node.
Vulnerability Detail
The vulnerability arises from the improper creation of ZONE_MOVABLE beyond the end of a node in the Kernel's memory allocation code. This flaw can potentially be exploited by an attacker to gain unauthorized access to sensitive information or execute arbitrary code. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability was introduced in version v2.6.23 of the Linux Kernel and has been fixed in version v5.10.110.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is advised to apply the official patch or update the Kernel to the fixed version.
Conclusion
The vulnerability in Kernel's mm/pages_alloc.c can potentially lead to unauthorized access or arbitrary code execution. It is crucial to update the Linux Kernel to version v5.10.110 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven. However, if successfully exploited, it could lead to unauthorized access to sensitive information or arbitrary code execution.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time monitoring and alerts for open-source vulnerabilities.
No, there is no specific workaround available for this vulnerability. It is recommended to update the Kernel to the fixed version.
The fixed version of the Linux Kernel (v5.10.110 or later) can be obtained from the official Linux Kernel repository or through your Linux distribution's package manager.
This vulnerability was discovered by an automated process and reported in the Open Source Vulnerability format. The actual impact and attack plausibility have not been proven yet.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
