Critical Use-After-Free Vulnerability in Linux Kernel Affecting Debian Packages
Summary
CVE-2022-49730: In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Resolve NULL ptr dereference after an ELS LOGO is aborted A use-after-free crash can occur after an ELS LOGO is aborted. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It is widely used across various distributions, including Debian. The kernel's stability and security are paramount, as vulnerabilities can lead to severe system crashes or unauthorized access. The specific vulnerability in question affects the SCSI lpfc driver, which is responsible for managing Fibre Channel connections, making it critical for environments relying on storage area networks.
Vulnerability Detail
In the Linux kernel, a use-after-free vulnerability has been identified in the lpfc driver. This issue arises when an ELS LOGO (Login) operation is aborted, leading to a null pointer dereference. Specifically, a nodelist structure is freed, but subsequent attempts to access ndlp->vport->cfg_log_verbose in the lpfc_nlp_get() function can cause a crash. This vulnerability can be exploited if the discovery state machine is incorrectly triggered a second time with the NLP_EVT_DEVICE_RM argument, potentially leading to system instability or crashes.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it becomes available to mitigate risks.
Conclusion
The identified use-after-free vulnerability in the Linux kernel's lpfc driver poses significant risks to system stability and security. It is essential for users of affected Debian packages to update to the patched version promptly. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time, ensuring better security management.
See every vulnerability recorded for linux →
FAQ
A use-after-free vulnerability occurs when a program continues to use a memory reference after it has been freed, potentially leading to crashes or exploitation.
You can use Vulert, which monitors open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without any signup.
Exploitation of this vulnerability can lead to system crashes, instability, or unauthorized access to system resources.
Yes, a patch is available for Debian 12 and 13 in version 5.18.14-1. It is recommended to update to this version.
While there are no specific workarounds, it is crucial to monitor for updates and apply them as soon as possible to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
