UAF in blk_trace access after removing by sysfs in Kernel
Summary
UVI-2021-1001664: blktrace: Fix uaf in blk_trace access after removing by sysfs. Affects Kernel versions >= c71a896154119f4ca9e89d6078f5f63ad60ef199, < 3815fe7371d2411ce164281cef40d9fc7b323dee. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that provides core functionalities and acts as an interface between hardware and software. It manages system resources, facilitates communication between different software components, and ensures the overall stability and security of the system. One of the features provided by the Kernel is blktrace, which allows users to trace block I/O events. However, a vulnerability has been identified in the Kernel related to blk_trace access after removal by sysfs.
Vulnerability Detail
The vulnerability in the Kernel arises from a use-after-free (UAF) issue in blk_trace access after removal by sysfs. When certain operations are performed on blk_trace through sysfs, a reference to the blk_trace object is not properly handled, leading to a situation where the object can still be accessed even after it has been removed. This can result in a variety of potential security risks, including the possibility of unauthorized access, information disclosure, or even remote code execution. The vulnerability was introduced in version v2.6.30 of the Kernel and has been fixed in version v5.10.70.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the use of blktrace or avoid performing operations on blk_trace through sysfs. This can be achieved by modifying the system configuration or disabling relevant modules. However, it is important to note that workarounds may not provide complete protection and updating to the fixed version of the Kernel is strongly recommended.
Conclusion
The UAF vulnerability in blk_trace access after removal by sysfs in the Kernel can pose significant security risks, including unauthorized access, information disclosure, or remote code execution. To mitigate these risks, it is crucial to update the Kernel to version v5.10.70 or later. Workarounds can provide temporary relief but may not offer complete protection. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can potentially lead to unauthorized access, information disclosure, or remote code execution, depending on the specific circumstances and the attacker's capabilities.
You can use tools like Vulert (https://vulert.com) to check if your system is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software.
At the time of this report, there is no known exploit publicly available for this vulnerability. However, it is important to apply the necessary updates and security patches to mitigate the risk.
As mentioned earlier, a temporary measure is to disable the use of blktrace or avoid performing operations on blk_trace through sysfs. However, it is strongly recommended to update the Kernel to the fixed version as soon as possible.
For more detailed information about this vulnerability, including technical details and the specific commits that address the issue, you can refer to the vulnerability database maintained by the Cloud Security Alliance at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1001xxx/UVI-2021-1001664.json.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
