Vulnerability in Linux Kernel: block: don't delete queue kobject before its children
Summary
GSD-2022-1002368: block: don't delete queue kobject before its children. Affects Kernel versions >= 2c2086afc2b8b974fac32cb028e73dc27bfae442, < b2001eb10f59363da930cdd6e086a2861986fa18. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is a widely used open-source operating system kernel that serves as the foundation for various Linux distributions. It provides core functionality and interfaces for hardware, software, and user applications. The block subsystem within the Linux Kernel handles block devices such as hard drives and SSDs. It manages the queues and operations related to these devices, ensuring efficient data transfer and storage. However, a vulnerability has been identified in the block subsystem that could lead to potential security risks.
Vulnerability Detail
The vulnerability arises from a flaw in the block subsystem's handling of queue kobjects. Specifically, the queue kobject is deleted before its children, which can result in undefined behavior and potential security issues. An attacker may exploit this vulnerability to manipulate the queue kobjects and potentially gain unauthorized access, execute arbitrary code, or cause a denial-of-service condition. The impact and attack plausibility of this vulnerability have not been proven yet. The vulnerability was introduced in version v4.16 of the Linux Kernel and has been fixed in version v4.19.238 by commit b2001eb10f59363da930cdd6e086a2861986fa18.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply the following patch to the affected code:
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -1230,8 +1230,8 @@ static void blk_cleanup_queue(struct request_queue *q)
kobject_put(&q->kobj);
}
- kobject_put(&q->kobj);
blk_free_flush_queue(q);
+ kobject_put(&q->kobj);
}
This patch ensures that the queue kobject is not deleted before its children, addressing the vulnerability.
Conclusion
In conclusion, a vulnerability has been identified in the block subsystem of the Linux Kernel that could potentially lead to security risks. It is recommended to update the Linux Kernel to version v4.19.238 or later to mitigate this vulnerability. Users can also apply the provided patch as a workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven, but it could potentially allow an attacker to gain unauthorized access, execute arbitrary code, or cause a denial-of-service condition.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time monitoring and alerts for open-source vulnerabilities, including this one.
Yes, a workaround is available. You can apply the provided patch to the affected code, as mentioned in the 'workaround' section of this report.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v4.19.238 or later. Refer to the 'how_to_fix' section of this report for detailed instructions.
You can find more information about this vulnerability in the GSD-2022-1002368 entry of the GSD Database (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1002xxx/GSD-2022-1002368.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
