Critical Vulnerability in Linux Kernel: Mailbox Timeout Handling in lpfc_get_sfp_info
Summary
DEBIAN-CVE-2024-46842: In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info The MBX_TIMEOUT return code is not handled in lpfc_get_sfp_info and the routine unconditionally... Affects linux versions < 6.10.11-1. Fixed in 6.10.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system resources. It supports a wide range of functionalities, including process management, memory management, and device drivers. The specific vulnerability affects the lpfc driver, which is responsible for managing Fibre Channel devices. This vulnerability arises from improper handling of mailbox timeouts, which can lead to memory corruption and system instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the lpfc driver related to the handling of mailbox timeouts in the lpfc_get_sfp_info function. The issue occurs when the MBX_TIMEOUT return code is not properly managed, leading to the unconditional freeing of mailbox commands regardless of their return status. This can result in the firmware referencing previously freed memory, potentially causing system crashes or unpredictable behavior. The vulnerability is critical as it can affect system stability and data integrity.
How To Fix
Minimum fixed version
6.10.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The vulnerability in the Linux kernel's lpfc driver poses significant risks to system stability and data integrity due to improper handling of mailbox timeouts. Users are strongly encouraged to update to the patched version 6.10.11-1 to mitigate these risks. Regular monitoring and prompt updates are essential to maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper handling of mailbox timeouts in the lpfc driver, which can lead to memory corruption.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
If exploited, this vulnerability can lead to system crashes, data corruption, and instability in applications relying on the lpfc driver.
Yes, a patch is available in version 6.10.11-1 of the Linux package. Users should update to this version or later.
While there are no specific workarounds, it is advisable to monitor your system closely and apply the patch as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
