Use After Free Vulnerabilities in drbd
Summary
GSD-2022-1002179: drbd: Fix five use after free bugs in get_initial_state. Affects Kernel versions >= a29728463b254ce81ecefdf20c1a02e01d9361da, < b6a4055036eed1f5e239ce3d8b0db1ce38bba447. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
drbd is a distributed replicated storage system for the Linux kernel. It allows block devices to be mirrored over a network, ensuring data redundancy and high availability. The system is commonly used in clustered environments to provide reliable storage for critical applications. However, several use after free vulnerabilities have been discovered in the get_initial_state function of drbd, which could potentially be exploited by an attacker to execute arbitrary code or cause a denial of service.
Vulnerability Detail
The use after free vulnerabilities in the get_initial_state function of drbd arise from improper handling of memory deallocation. When certain conditions are met, the function may free a memory object and later attempt to access it, leading to undefined behavior. An attacker could potentially exploit this vulnerability by carefully crafting a malicious request to trigger the use after free condition, allowing them to execute arbitrary code or crash the system. These vulnerabilities were introduced in version 4.5 of the Linux Kernel and have been fixed in version 5.4.189.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the affected functionality or module in the kernel configuration. However, this may result in the loss of certain features or capabilities provided by drbd. It is strongly recommended to apply the official patch or update the kernel as soon as possible to ensure the security and stability of the system.
Conclusion
The use after free vulnerabilities in the get_initial_state function of drbd pose a significant security risk, as they could allow an attacker to execute arbitrary code or crash the system. It is crucial for users to update their Linux Kernel to version 5.4.189 or later to mitigate these vulnerabilities. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
drbd is a distributed replicated storage system for the Linux kernel that provides block-level mirroring over a network.
A use after free vulnerability occurs when a program continues to use a memory object after it has been freed, leading to undefined behavior and potential security issues.
An attacker can exploit these vulnerabilities by crafting a malicious request that triggers the use after free condition, allowing them to execute arbitrary code or crash the system.
Versions 4.5 to 5.4.188 of the Linux Kernel are affected by these use after free vulnerabilities in the get_initial_state function of drbd.
Yes, the vulnerabilities have been fixed in version 5.4.189 of the Linux Kernel.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
