Kernel Vulnerability in Linux Package: SCSI Device Teardown Race Condition
Summary
DEBIAN-CVE-2024-35954: In the Linux kernel, the following vulnerability has been resolved: scsi: sg: Avoid sg device teardown race sg_remove_sfp_usercontext() must not use sg_device_destroy() after calling scsi_device_put(). Affects linux versions < 6.8.9-1. Fixed in 6.8.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and hardware communication. It provides essential services for all other software running on the system. The kernel is modular, allowing for various functionalities to be added or removed as needed. However, vulnerabilities can arise, such as the one identified in this report, which affects the SCSI (Small Computer System Interface) subsystem, specifically related to device teardown processes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the SCSI subsystem, specifically within the sg (SCSI generic) device handling. The issue arises from a race condition during the teardown of sg devices, where the function sg_remove_sfp_usercontext() improperly calls sg_device_destroy() after invoking scsi_device_put(). This sequence leads to a NULL pointer dereference, potentially causing a kernel crash. The vulnerability can severely impact system stability and reliability, especially in environments relying on SCSI devices for storage and data transfer.
How To Fix
Minimum fixed version
6.8.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is recommended to apply the patch as soon as it becomes available to mitigate any risks associated with this issue.
Conclusion
The identified vulnerability in the Linux kernel's SCSI subsystem poses a significant risk to system stability. Users are urged to update to the patched version 6.8.9-1 to protect their systems from potential crashes and data loss. Monitoring tools like Vulert can assist in identifying such vulnerabilities in the future.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a race condition in the SCSI subsystem of the Linux kernel that can lead to a kernel crash due to a NULL pointer dereference.
If exploited, this vulnerability can cause instability and crashes in systems that utilize SCSI devices, potentially leading to data loss or system downtime.
If you are using the Linux kernel versions prior to 6.8.9-1, your system may be vulnerable. You can check your system's kernel version using the command 'uname -r'.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json. You can check for vulnerabilities in your application using the Vulert playground without any signup.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate risks associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
