Vulnerability in Kernel: block, bfq: don't move oom_bfqq
Summary
GSD-2022-1002223: block, bfq: don't move oom_bfqq. Affects Kernel versions < c4f5a678add58a8a0e7ee5e038496b376ea6d205. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages communication between hardware and software. It provides essential functions for the system, including memory management, process scheduling, and device drivers. The block subsystem in the Kernel handles I/O operations for block devices such as hard drives and SSDs. The bfq (Budget Fair Queueing) is a block I/O scheduler that aims to provide fairness and low latency for I/O operations. However, a vulnerability has been discovered in the Kernel's block subsystem related to the bfq scheduler's handling of out-of-memory (OOM) situations.
Vulnerability Detail
The vulnerability in the Kernel's block subsystem allows an attacker to potentially exploit the bfq scheduler's behavior during OOM situations. By manipulating the OOM conditions, an attacker could cause the Kernel to move the out-of-memory bfq queue (oom_bfqq) to a different process group, potentially leading to resource starvation or denial of service. The impact and attack plausibility of this vulnerability have not been proven yet, but it is important to address it to ensure system stability and security.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, applying the recommended fix by updating the Kernel to the latest version will address the issue.
Conclusion
The vulnerability in the Kernel's block subsystem related to the bfq scheduler's handling of OOM situations can potentially be exploited to cause resource starvation or denial of service. It is crucial to update the Linux Kernel to version v5.4.189 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel is a critical component of the Linux operating system that manages communication between hardware and software.
The block subsystem in the Kernel handles I/O operations for block devices such as hard drives and SSDs.
The bfq (Budget Fair Queueing) is a block I/O scheduler in the Kernel that aims to provide fairness and low latency for I/O operations.
An out-of-memory (OOM) situation occurs when the system runs out of available memory to allocate to processes.
Resource starvation or denial of service refers to a situation where a process or system is deprived of essential resources, leading to degraded performance or unavailability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
