Vulnerability in Kernel: scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp()
Summary
GSD-2022-1002822: scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp(). Affects Kernel versions < 7860d8f8082605b57596aa82d3d438c1fdad9a9e. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionality and interfaces with hardware devices. It manages system resources, facilitates communication between software and hardware, and supports various subsystems. The lpfc driver in the Kernel is responsible for handling SCSI (Small Computer System Interface) commands for Fibre Channel storage devices. It allows communication between the host system and Fibre Channel storage arrays.
The vulnerability identified in the lpfc driver can lead to a resource leak in the lpfc_sli4_send_seq_to_ulp() function. This function is responsible for sending sequence level information to the upper layer protocol (ULP) in the SCSI layer. The resource leak can result in memory or other system resource exhaustion, potentially leading to system instability or denial of service.
Vulnerability Detail
The vulnerability in the lpfc_sli4_send_seq_to_ulp() function of the lpfc driver can be exploited by an attacker to cause resource exhaustion. By repeatedly triggering the vulnerable function, an attacker can consume excessive memory or other system resources, leading to system instability or denial of service. The impact of this vulnerability may vary depending on the specific system configuration and workload.
The vulnerability has been addressed in the Linux Kernel version v5.18.3 by commit 7860d8f8082605b57596aa82d3d438c1fdad9a9e. It is recommended to update the Kernel to the fixed version to mitigate the vulnerability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is recommended to apply the fix by updating the Linux Kernel to the patched version.
Conclusion
The vulnerability in the lpfc driver of the Kernel can result in resource exhaustion, potentially leading to system instability or denial of service. It is crucial to update the Linux Kernel to version v5.18.3 or later, which includes the necessary fix. Regularly applying security updates and patches is essential to maintain the security and stability of the system.
For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to resource exhaustion, potentially causing system instability or denial of service.
You can check the version of the Linux Kernel installed on your system. If it is earlier than v5.18.3, your system may be affected.
At the time of this report, there are no known public exploits targeting this specific vulnerability.
The vulnerability requires local access to the system to trigger the vulnerable function. However, if an attacker gains local access, they can exploit the vulnerability remotely by executing malicious code.
Yes, the vulnerability has been fixed in the Linux Kernel version v5.18.3. It is recommended to update the Kernel to the fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
