Vulnerability in Kernel package: scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand()
Summary
GSD-2021-1000118: scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand(). Affects Kernel versions >= af2a0c51b1205327f55a7e82e530403ae1d42cbb, < 80ef24175df2cba3860d0369d1c662b49ee2de56. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system, responsible for managing the system's core functionality. It provides an interface between the hardware and software layers, allowing applications to communicate with the underlying hardware. The scsi: qla2xxx module within the Kernel package is specifically designed to support QLogic Fibre Channel Host Bus Adapters (HBAs). These HBAs enable high-speed data transfer between servers and storage devices. However, a vulnerability has been identified in the qla2xxx_mqueuecommand() function, which can lead to system crashes and potential security breaches.
Vulnerability Detail
The vulnerability in the qla2xxx_mqueuecommand() function within the scsi: qla2xxx module allows an attacker to trigger a crash in the system. By sending a specially crafted command to the HBA, an attacker can exploit this vulnerability and cause a denial-of-service (DoS) condition. This can result in system instability, loss of data, and potential unauthorized access to sensitive information. The vulnerability was introduced in version v5.5 of the Linux Kernel and has been fixed in version v5.11.20.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Kernel package is not immediately feasible, a temporary workaround can be implemented to mitigate the risk. It involves disabling the affected scsi: qla2xxx module by blacklisting it. This can be done by adding the following line to the '/etc/modprobe.d/blacklist.conf' file:
blacklist qla2xxx
After adding the blacklist entry, reboot the system for the changes to take effect. However, it is important to note that this workaround only disables the vulnerable module and may impact the functionality of QLogic Fibre Channel HBAs.
Conclusion
The vulnerability in the scsi: qla2xxx module of the Kernel package can lead to system crashes, denial-of-service (DoS) conditions, and potential unauthorized access. It is crucial to update the Kernel package to version v5.11.20 or later to patch this vulnerability. If immediate update is not possible, a temporary workaround of blacklisting the qla2xxx module can be implemented. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to system crashes, denial-of-service (DoS) conditions, potential data loss, and unauthorized access to sensitive information.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected. Simply upload your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this specific vulnerability.
At the time of this report, there is no known public exploit for this vulnerability. However, it is important to apply the recommended fixes as soon as possible to prevent any potential exploitation.
While the workaround can temporarily mitigate the risk, it is recommended to update the Kernel package to the latest version as soon as possible. This ensures that the vulnerability is fully patched and the system is protected against potential exploits.
You can find more information about this vulnerability, including the exact code changes and fixes, in the official GitHub repository of the Cloud Security Alliance's GSD Database (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1000xxx/GSD-2021-1000118.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
