Memory Leak Vulnerability in scsi: lpfc
Summary
GSD-2022-1002836: scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT. Affects Kernel versions < c00df0f34a6d5e14da379f96ea67e501ce67b002. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The scsi: lpfc package is a component of the Linux Kernel that provides support for Fibre Channel over Ethernet (FCoE) and Fibre Channel (FC) storage protocols. It allows for the communication between the host system and storage devices. The package is widely used in Linux-based systems and is critical for storage operations.
Vulnerability Detail
The vulnerability identified as GSD-2022-1002836 in scsi: lpfc can lead to a memory leak when NPIV (N_Port ID Virtualization) ports send a PLOGI_RJT (Port Login Reject) message. This can result in the gradual consumption of system memory, potentially leading to performance degradation or even system instability. The vulnerability has been fixed in Linux Kernel version v5.18.3 by commit c00df0f34a6d5e14da379f96ea67e501ce67b002.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Linux Kernel is not immediately feasible, a temporary workaround can be implemented by disabling NPIV ports or preventing them from sending PLOGI_RJT messages. This can be achieved by modifying the configuration of the scsi: lpfc module or related settings. However, it is important to note that this workaround may impact the functionality of NPIV ports and should only be considered as a temporary measure until the kernel update can be applied.
Conclusion
The memory leak vulnerability in scsi: lpfc can have significant implications for system performance and stability. It is crucial to update the Linux Kernel to the fixed version or apply the recommended workaround to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
scsi: lpfc is a component of the Linux Kernel that provides support for Fibre Channel over Ethernet (FCoE) and Fibre Channel (FC) storage protocols.
NPIV (N_Port ID Virtualization) is a technology that allows multiple virtual Fibre Channel ports to share a single physical port. It enables virtualization and consolidation of Fibre Channel resources.
PLOGI_RJT (Port Login Reject) is a Fibre Channel control message sent by a Fibre Channel port to reject a login request from another port. It indicates that the login request is not accepted or supported.
The memory leak caused by this vulnerability can lead to gradual consumption of system memory, potentially resulting in performance degradation or system instability.
Yes, the vulnerability has been fixed in Linux Kernel version v5.18.3 by commit c00df0f34a6d5e14da379f96ea67e501ce67b002.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
