Use After Free Vulnerabilities in drbd
Summary
GSD-2022-1002308: drbd: Fix five use after free bugs in get_initial_state. Affects Kernel versions >= a29728463b254ce81ecefdf20c1a02e01d9361da, < 188fe6b26765edbad4055611c0f788b6870f4024. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The drbd package is a distributed replicated block device driver for Linux. It allows multiple servers to share the same storage device in a high-availability setup. The package is commonly used in clustered environments to provide data replication and failover capabilities. However, several use after free vulnerabilities have been discovered in the get_initial_state function of drbd.
Vulnerability Detail
The use after free vulnerabilities in the get_initial_state function of drbd can be exploited by an attacker to execute arbitrary code or cause a denial of service. These vulnerabilities occur when the function improperly handles memory deallocation, leading to references to freed memory. By manipulating the freed memory, an attacker can potentially control program execution or crash the system. The vulnerabilities were introduced in version v4.5 of the Linux Kernel and have been fixed in version v4.19.238.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for these vulnerabilities. It is essential to apply the patch provided in the updated version of the Linux Kernel.
Conclusion
The use after free vulnerabilities in drbd can have serious security implications, allowing attackers to execute arbitrary code or cause a denial of service. It is crucial to update the Linux Kernel to the patched version to mitigate these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
drbd is a distributed replicated block device driver for Linux that enables multiple servers to share the same storage device in a high-availability setup.
The use after free vulnerabilities in drbd can allow an attacker to execute arbitrary code or cause a denial of service.
To fix these vulnerabilities, update the Linux Kernel to version v4.19.238 or later.
No, there are no known workarounds for these vulnerabilities. Applying the patch provided in the updated version of the Linux Kernel is necessary.
You can find more information about these vulnerabilities in the Open Source Vulnerability Database (OSVDB) with the ID GSD-2022-1002308.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
