Race Condition Vulnerability in Linux Kernel's qla2xxx Package
Summary
CVE-2022-49159: In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Implement ref count for SRB The timeout handler and the done function are racing. Affects linux versions < 5.17.3-1. Fixed in 5.17.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of Linux operating systems, responsible for managing hardware and system resources. The qla2xxx package is a driver for QLogic Fibre Channel host bus adapters, facilitating communication between the operating system and the hardware. This package is crucial for systems relying on Fibre Channel storage networks, and vulnerabilities within it can lead to severe system instability and data integrity issues.
Vulnerability Detail
The vulnerability, identified as CVE-2022-49159, arises from a race condition between the timeout handler and the response path in the qla2xxx driver. When the timeout handler is invoked, it can be preempted by the normal response path, leading to the release of a shared resource (SRB) while it is still being accessed. This results in a NULL pointer dereference, causing potential system crashes or undefined behavior. The issue stems from inadequate synchronization between the normal and timeout paths, which can lead to accessing freed memory.
How To Fix
Minimum fixed version
5.17.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users are advised to monitor their systems for any unusual behavior and apply the patch as soon as it is available.
Conclusion
CVE-2022-49159 is a critical vulnerability in the Linux kernel's qla2xxx driver that can lead to severe system instability due to a race condition. Users are strongly encouraged to update their systems to the patched versions to mitigate the risk. Monitoring tools like Vulert can assist in identifying vulnerabilities in your applications.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49159 is a vulnerability in the Linux kernel's qla2xxx driver that results from a race condition, potentially leading to system crashes.
This vulnerability can cause kernel panics or undefined behavior, leading to system instability and potential data loss.
Yes, the patched versions for Debian 12 and 13 are 5.17.3-1 or later. Users should update their systems accordingly.
While there are no specific workarounds, it is advisable to monitor your system for unusual behavior and plan to apply the patch as soon as possible.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground at Vulert Scanner without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
