Vulnerability in Kernel package: mm/pages_alloc.c
Summary
GSD-2022-1002511: mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node. Affects Kernel versions >= 2a1e274acf0b1c192face19a4be7c12d4503eaaf, < 43397f238aa344b21f101b59e626bb2ddb943f6c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is an integral part of the Linux operating system. It provides essential functionality for managing system resources, including memory allocation. The mm/pages_alloc.c file within the Kernel package is responsible for allocating memory pages. However, a vulnerability has been discovered in this file that allows the creation of a ZONE_MOVABLE beyond the end of a node. This vulnerability was introduced in version v2.6.23 of the Linux Kernel and has been fixed in version v4.9.311.
Vulnerability Detail
The vulnerability in mm/pages_alloc.c allows the creation of ZONE_MOVABLE beyond the end of a node. While the impact and attack plausibility have not been proven, this vulnerability has the potential to be exploited by malicious actors. It could lead to memory corruption or other security issues within the system. The vulnerability was introduced in version v2.6.23 of the Linux Kernel and has been fixed in version v4.9.311 by commit 43397f238aa344b21f101b59e626bb2ddb943f6c.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, the Kernel package in the Linux operating system is vulnerable to a memory allocation issue in the mm/pages_alloc.c file. This vulnerability has the potential to be exploited by attackers, leading to memory corruption or other security issues. It is crucial to update to the fixed version of the Linux Kernel package (v4.9.311 or later) to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven, but it has the potential to lead to memory corruption or other security issues within the system.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will alert you in real-time if the vulnerability is present.
There is no evidence of this vulnerability being exploited in the wild at this time.
No known workarounds have been identified for this vulnerability. It is recommended to update to the fixed version of the Linux Kernel package.
You can find more information about this vulnerability in the GSD database entry: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1002xxx/GSD-2022-1002511.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
