Deadlock Vulnerability in Linux Kernel SCSI UFS Driver
Summary
CVE-2021-47622: In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: Fix a deadlock in the error handler The following deadlock has been observed on a test setup: - All tags allocated - The SCSI error handler c... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system resources. The SCSI (Small Computer System Interface) UFS (Universal Flash Storage) driver is responsible for managing storage devices. This driver is critical for ensuring efficient communication between the operating system and storage hardware. The vulnerability in question arises from a deadlock condition that can occur during error handling, potentially leading to system hangs and degraded performance.
Vulnerability Detail
In the Linux kernel, a deadlock has been identified in the SCSI UFS driver, specifically during the error handling process. When all tags are allocated, the SCSI error handler invokes the ufshcd_eh_host_reset_handler(), which queues work that calls ufshcd_err_handler(). This function can lock up due to resource contention, leading to a situation where the system cannot proceed with normal operations. The vulnerability can result in significant performance issues and system instability, particularly in environments relying heavily on SCSI storage devices.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the recommended updates to the Linux kernel as soon as they are available.
Conclusion
CVE-2021-47622 represents a significant vulnerability in the Linux kernel's SCSI UFS driver, leading to potential deadlocks during error handling. Users are advised to update their systems to the latest kernel versions to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security and performance.
See every vulnerability recorded for linux →
FAQ
CVE-2021-47622 is a vulnerability in the Linux kernel's SCSI UFS driver that can lead to a deadlock during error handling, causing system hangs.
This vulnerability can lead to performance degradation and system instability, particularly in systems that rely on SCSI storage devices.
The vulnerability affects multiple versions of the Linux kernel, particularly those in Debian 11, 12, and 13, prior to the fix in version 5.16.11-1.
You can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
The CVSS score for CVE-2021-47622 is 5.5, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
