SCSI Abort Handling Improvement in Linux Kernel - CVE-2021-47188
Summary
CVE-2021-47188: In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Improve SCSI abort handling The following has been observed on a test setup: WARNING: CPU: 4 PID: 250 at drivers/scsi/ufs/ufshcd.c:2737... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system resources. It supports a wide range of hardware and is known for its stability and performance. The kernel's SCSI (Small Computer System Interface) subsystem is responsible for managing storage devices. This vulnerability specifically affects the UFS (Universal Flash Storage) driver within the SCSI subsystem, which is crucial for handling commands to storage devices.
Vulnerability Detail
CVE-2021-47188 is a vulnerability in the Linux kernel's SCSI UFS driver that arises from improper handling of command aborts. The issue is triggered when the system attempts to abort a command, leading to a warning in the kernel logs. The warning indicates that a command is still present in the command block when it should have been cleared, potentially leading to undefined behavior or system instability. This vulnerability can affect systems relying on UFS storage, causing errors during command execution and impacting overall system reliability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best approach is to apply the kernel update as soon as it is available.
Conclusion
CVE-2021-47188 is a significant vulnerability in the Linux kernel's SCSI UFS driver that can lead to system instability due to improper command abort handling. Users are advised to update their kernel to the latest version to ensure protection against this issue. Regular monitoring using tools like Vulert can help maintain awareness of vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
CVE-2021-47188 is a vulnerability in the Linux kernel's SCSI UFS driver that affects command abort handling, potentially leading to system instability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
If exploited, this vulnerability could lead to undefined behavior during command execution, resulting in errors and potential system crashes.
The vulnerability affects all versions of the Linux kernel prior to the fix implemented in version 5.15.5-1 for Debian 12 and 13.
Yes, a patch is available in the form of an updated kernel version. Users should upgrade to at least version 5.15.5-1 to mitigate the issue.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
