Vulnerability in Kernel package: scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand()
Summary
GSD-2021-1000078: scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand(). Affects Kernel versions >= af2a0c51b1205327f55a7e82e530403ae1d42cbb, < a73208e3244127ef9f2cdf24e4adb947aaa32053. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Kernel package is an essential component of the Linux operating system, responsible for managing the system's core functionality. It provides various drivers and modules to enable communication between hardware devices and software applications. One of the drivers included in the Kernel package is the qla2xxx driver, which is used for QLogic Fibre Channel Host Bus Adapter (HBA) cards. These cards allow servers to connect to Fibre Channel storage devices. However, a vulnerability has been discovered in the qla2xxx driver that can lead to a system crash when executing the qla2xxx_mqueuecommand() function.
Vulnerability Detail
The vulnerability in the qla2xxx driver arises from a flaw in the qla2xxx_mqueuecommand() function. When certain conditions are met, an attacker could exploit this flaw to trigger a crash in the system. The impact of this vulnerability could result in a denial of service (DoS) situation, rendering the affected system unavailable. The vulnerability was introduced in version v5.5 of the Linux Kernel and has been fixed in version v5.12.3.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel package to version v5.12.3 or later. This update includes the necessary patch to address the flaw in the qla2xxx driver. Users can obtain the updated Kernel package from the official Linux Kernel repository. Detailed instructions on how to update the Kernel package can be found in the documentation provided by the Linux distribution being used.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the qla2xxx driver if it is not essential for their system's operation. This can be achieved by blacklisting the driver module or removing it from the Kernel configuration. However, it is important to note that disabling the driver may result in the loss of functionality related to QLogic Fibre Channel HBAs.
Conclusion
In conclusion, a vulnerability has been identified in the Kernel package's qla2xxx driver, which can lead to a system crash. It is crucial to update the Linux Kernel package to version v5.12.3 or later to mitigate this vulnerability. Alternatively, users can disable the qla2xxx driver as a workaround, although this may result in the loss of QLogic Fibre Channel HBA functionality. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel package is a crucial component of the Linux operating system, responsible for managing core system functionality and providing drivers for hardware devices.
The qla2xxx driver is a component of the Kernel package that enables communication between the Linux system and QLogic Fibre Channel Host Bus Adapter (HBA) cards.
The vulnerability can lead to a system crash, resulting in a denial of service (DoS) situation where the affected system becomes unavailable.
To fix this vulnerability, it is recommended to update the Linux Kernel package to version v5.12.3 or later, which includes the necessary patch to address the flaw.
Yes, as a workaround, you can disable the qla2xxx driver if it is not essential for your system's operation. However, this may result in the loss of functionality related to QLogic Fibre Channel HBAs.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.