CVE-2022-50506: drbd: only clone bio if we have a backing device
In the Linux kernel, the following vulnerability has been resolved:
drbd: only clone bio if we have a backing device
Commit c347a787e34cb (drbd: set ->bibdev in drbdreqnew) moved a biosetdev call (which has since been removed) to "earlier", from drbdrequestprepare to drbdreqnew.
The problem is that this accesses device->ldev->backingbdev, which is not NULL-checked at this point. When we don't have an ldev (i.e. when the DRBD device is diskless), this leads to a null pointer deref.
So, only allocate the privatebio if we actually have a disk. This is also a small optimization, since we don't clone the bio to only to immediately free it again in the diskless case.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50506?
CVE-2022-50506 is classified as a low severity vulnerability in the Linux kernel.
How do I fix CVE-2022-50506?
To mitigate CVE-2022-50506, users should update their Linux kernel to a version that includes the fix for this vulnerability.
What components are affected by CVE-2022-50506?
CVE-2022-50506 specifically affects the Distributed Replicated Block Device (DRBD) functionality within the Linux kernel.
What happens if CVE-2022-50506 is exploited?
Exploitation of CVE-2022-50506 could potentially lead to inconsistencies in data replication, impacting the reliability of the DRBD service.
When was CVE-2022-50506 published?
CVE-2022-50506 was published in December 2022 as part of the ongoing security efforts for the Linux kernel.