Linux Kernel Multipath Target Race Condition Vulnerability Leading to Memory Corruption

A race condition vulnerability has been identified in the Linux kernel's multipath target. This issue arises in the 'retrieve_deps' function, which traverses a list of open devices without holding a lock. Meanwhile, the 'multipath_message' function can add or remove devices from the list, leading to potential memory corruption or use-after-free errors. The vulnerability has been addressed by introducing a read-write semaphore, 'devices_lock', to synchronize access to the device list.

Impact

Exploitation of this vulnerability can cause memory corruption or use-after-free conditions, potentially leading to arbitrary code execution or other memory-related vulnerabilities.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the official Linux kernel website.