CVE-2024-36952: Vulnerability in linux-libc-dev package - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
Summary
CVE-2024-36952: In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up There are cases after NPIV deletion where the fabric switch still believes t... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux-libc-dev package is a development package that provides the necessary header files and libraries for compiling C programs that use the Linux kernel interfaces. It is a crucial component for building and running applications on Linux systems. The package is widely used and is included in various Linux distributions.
The vulnerability in the linux-libc-dev package affects the scsi subsystem's lpfc driver. The issue arises when a virtual port (vport) is unregistered before certain control messages are sent to the fabric switch. This can lead to a race condition where the fabric switch still believes the vport is logged into the fabric, causing potential inconsistencies and issues.
The vulnerability has been assigned the CVE identifier CVE-2024-36952 and has a CVSS score of 5.5, indicating a medium severity level.
Vulnerability Detail
The vulnerability in the linux-libc-dev package's scsi: lpfc driver occurs when a vport is unregistered before the Remove All DA_ID CT and LOGO ELS (Exchange Link Service) messages are sent to the fabric switch. This can result in the fabric switch still considering the vport as logged into the fabric, leading to potential inconsistencies and problems.
The issue is caused by the current implementation of fc_remove_host() and scsi_remove_host() functions, which are responsible for removing the vport and associated resources. These functions are called before the necessary control messages are sent, creating a race condition.
To address this vulnerability, the fc_remove_host() and scsi_remove_host() calls need to be moved after the DA_ID and LOGO messages are sent to the fabric switch. This ensures that the necessary cleanup operations are performed before unregistering the vport, avoiding the race condition and potential fabric switch inconsistencies.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to follow the steps mentioned in the 'how_to_fix' section to address the issue.
Conclusion
The vulnerability in the linux-libc-dev package's scsi: lpfc driver can lead to potential inconsistencies and issues when unregistering a vport. To address this vulnerability, it is important to update the package to a version that includes the fix. Alternatively, consider using an alternative package or library that does not exhibit the vulnerability. Regularly monitoring for updates and applying them promptly is crucial for maintaining the security of the system.
For further support on vulnerability remediation and to check if your application is affected by this vulnerability, you can use Vulert (https://vulert.com). Vulert provides real-time monitoring and alerts for open-source vulnerabilities without requiring access to the code or installation.
See every vulnerability recorded for linux →
FAQ
The linux-libc-dev package provides the necessary header files and libraries for compiling C programs that use the Linux kernel interfaces. It is an essential component for building and running applications on Linux systems.
The scsi: lpfc driver is a component of the Linux kernel's SCSI subsystem. It is responsible for handling communication with Fibre Channel storage devices.
A vport, or virtual port, is a virtual representation of a physical Fibre Channel port. It allows for the creation of multiple virtual ports on a single physical port, enabling virtualization and isolation of storage resources.
A race condition is a situation in which the behavior of a system depends on the relative timing of events. In this vulnerability, the race condition occurs when the vport is unregistered before the necessary control messages are sent, leading to potential inconsistencies.
The CVSS score of this vulnerability is 5.5, indicating a medium severity level. CVSS (Common Vulnerability Scoring System) is a standardized method for assessing the severity of vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
