Vulnerability in Kernel: scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp()
Summary
GSD-2022-1003126: scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp(). Affects Kernel versions < 08709769ff2fb6c5ffedcda3742700d8ea1618a8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionalities and interfaces with hardware devices. It manages system resources, facilitates communication between software and hardware, and ensures the stability and security of the system. The lpfc driver in the Kernel is responsible for handling SCSI (Small Computer System Interface) commands for Fibre Channel storage devices. This vulnerability specifically affects the lpfc_sli4_send_seq_to_ulp() function in the lpfc driver.
Vulnerability Detail
The lpfc_sli4_send_seq_to_ulp() function in the lpfc driver in the Kernel suffers from a resource leak vulnerability. This vulnerability could be exploited by an attacker to exhaust system resources, leading to a denial-of-service condition. The vulnerability originates from improper handling of resources during the execution of the lpfc_sli4_send_seq_to_ulp() function. By repeatedly triggering this function with specially crafted requests, an attacker could cause resource exhaustion, potentially impacting the availability of the system. This vulnerability has been assigned the ID GSD-2022-1003126.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The vulnerability in the Kernel's lpfc driver, identified as GSD-2022-1003126, could allow an attacker to exhaust system resources and cause a denial-of-service condition. To mitigate this vulnerability, it is crucial to update the Linux Kernel to version v5.17.14 or later, which includes the necessary fix. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability could lead to a denial-of-service condition by exhausting system resources, potentially impacting the availability of the system.
No, authentication is not required to exploit this vulnerability. An attacker can trigger the vulnerable function remotely.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
Yes, this vulnerability can be exploited remotely by sending specially crafted requests to the vulnerable function.
No specific workaround has been provided for this vulnerability. It is recommended to update the Kernel to the patched version.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
