Vulnerability in Kernel package: scsi: lpfc: Move cfg_log_verbose check before calling lpfc_dmp_dbg()
Summary
GSD-2022-1002845: scsi: lpfc: Move cfg_log_verbose check before calling lpfc_dmp_dbg(). Affects Kernel versions < 09c772557a4fd9490fed1bfb133268313ea22213. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a fundamental component of the Linux operating system, responsible for managing the system's core functionality. It provides an interface between the hardware and software layers, allowing applications to communicate with the underlying hardware. The scsi (Small Computer System Interface) subsystem within the Kernel handles storage devices, such as hard drives and tape drives. The lpfc driver is used for Fibre Channel storage area networks (SANs) and is part of the scsi subsystem. This vulnerability specifically affects the lpfc driver in the Kernel package.
Vulnerability Detail
The vulnerability identified in the lpfc driver is related to the order of operations when checking the 'cfg_log_verbose' flag before calling the 'lpfc_dmp_dbg()' function. Currently, the check is performed after calling the function, which may result in unnecessary debug messages being logged. An attacker could potentially exploit this vulnerability to flood the system logs with debug messages, leading to a denial-of-service (DoS) condition or obscuring more critical log entries. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the vulnerability in the Kernel package's lpfc driver can potentially result in log flooding and impact system performance or log visibility. It is recommended to update to Linux Kernel version v5.18.3 or a later version to address this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel package is a crucial component of the Linux operating system, responsible for managing the system's core functionality and providing an interface between the hardware and software layers.
The scsi (Small Computer System Interface) subsystem within the Kernel handles storage devices, such as hard drives and tape drives.
The lpfc driver is used for Fibre Channel storage area networks (SANs) and is part of the scsi subsystem in the Kernel package.
The impact of this vulnerability is not yet proven. However, it could potentially lead to a denial-of-service (DoS) condition or obscure critical log entries by flooding the system logs with unnecessary debug messages.
To fix this vulnerability, update the Kernel package to version v5.18.3 or later, which includes the necessary fix implemented through commit 09c772557a4fd9490fed1bfb133268313ea22213.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
