Kernel Panic Vulnerability in Linux Package: SCSI Host Removal Issue
Summary
DEBIAN-CVE-2024-46843: In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Remove SCSI host only if added If host tries to remove ufshcd driver from a UFS device it would cause a kernel panic if ufshcd_async_sc... Affects linux versions < 6.10.11-1. Fixed in 6.10.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the Debian operating system, responsible for managing hardware and system resources. It provides essential services for all other software running on the system. The kernel is modular, allowing for various drivers and subsystems to be loaded dynamically. This flexibility, while beneficial, can also introduce vulnerabilities, such as the one identified in this report, which affects the SCSI host management in UFS devices.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the SCSI subsystem related to the UFS driver. Specifically, if the ufshcd driver is removed from a UFS device while the SCSI host has not been properly added, it can lead to a kernel panic. This situation arises when the ufshcd_async_scan fails during the ufshcd_probe_hba process, particularly when Multi-Command Queueing (MCQ) is enabled. The issue stems from the improper handling of the scsi_host_added flag, which should only be set after a successful addition of the SCSI host.
How To Fix
Minimum fixed version
6.10.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate the risk of a kernel panic.
Conclusion
The identified vulnerability in the Linux kernel regarding SCSI host management poses a significant risk of kernel panic. It is essential for users of Debian 13 and 14 to update their Linux package to the fixed version 6.10.11-1 to mitigate this risk. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to a kernel panic, causing the system to crash and become unresponsive.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to avoid potential system crashes.
Yes, the vulnerability affects Debian 13 and Debian 14 versions of the Linux package.
Vulert is a tool that monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. It provides real-time alerts for vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
