Critical Vulnerability in Linux Package: Uninitialized Work Queue in SCSI Driver
Summary
DEBIAN-CVE-2024-50025: In the Linux kernel, the following vulnerability has been resolved: scsi: fnic: Move flush_work initialization out of if block After commit 379a58caa199 ("scsi: fnic: Move fnic_fnic_flush_tx() to a work queue"), it can h... Affects linux versions < 6.11.4-1. Fixed in 6.11.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It is responsible for handling various system calls and managing interactions between the software and hardware. This vulnerability specifically affects the SCSI driver, which is crucial for managing storage devices. The issue arises from improper initialization of a work queue, potentially leading to system instability and failure to rediscover Fibre Channel devices after temporary failures.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the SCSI driver related to the fnic module. The issue stems from a commit that moved the initialization of a work queue inside a conditional block. This can result in a work item being sent to an uninitialized work queue, causing it to never be queued. As a consequence, any operations dependent on this work item may fail, leading to warnings during the driver load process and potentially breaking the rediscovery of Fibre Channel devices after a temporary fabric failure.
How To Fix
Minimum fixed version
6.11.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it is available to prevent potential issues.
Conclusion
The identified vulnerability in the Linux package's SCSI driver poses significant risks to system stability and functionality. It is essential to apply the available patch to mitigate these risks and ensure the proper operation of Fibre Channel devices. Regular monitoring and updates are crucial for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves the uninitialized work queue in the SCSI driver, which can lead to system instability.
It may prevent the rediscovery of Fibre Channel devices after temporary failures, potentially disrupting storage operations.
Yes, the patch is included in version 6.11.4-1 of the Linux package.
While no specific workarounds are available, it is crucial to monitor the situation and apply the patch as soon as possible.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file like package-lock.json. Visit Vulert Scanner to check your application without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
