Vulnerability in Kernel: scsi: lpfc: Fix call trace observed during I/O with CMF enabled
Summary
GSD-2022-1003396: scsi: lpfc: Fix call trace observed during I/O with CMF enabled. Affects Kernel versions < ae373d66c427812754db5292eb1481b181daf9ce. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionalities and acts as an interface between the hardware and software layers. It manages system resources, facilitates communication between different software components, and ensures the overall stability and security of the system. The scsi (Small Computer System Interface) subsystem within the Kernel enables communication with SCSI devices, such as hard drives and tape drives. The lpfc driver is responsible for managing Fibre Channel Host Bus Adapters (HBAs) that connect the system to Fibre Channel storage networks. This vulnerability specifically affects the lpfc driver when Continuous Monitoring and Feedback (CMF) is enabled.
Vulnerability Detail
The identified vulnerability in the lpfc driver occurs when performing Input/Output (I/O) operations with CMF enabled. It leads to a call trace, indicating a potential issue with the driver's implementation. While the exact impact and attack plausibility have not been proven, this vulnerability could potentially result in system instability, data corruption, or denial of service. The vulnerability has been addressed in the Linux Kernel version v5.15.46 through the commit ae373d66c427812754db5292eb1481b181daf9ce.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by disabling CMF if it is not essential for their system's operation. This can be done by modifying the configuration settings of the lpfc driver or the Kernel.
Conclusion
In conclusion, the identified vulnerability in the lpfc driver of the Kernel can lead to system instability and potential data corruption or denial of service. It is crucial to update the Linux Kernel to version v5.15.46 or later to mitigate this vulnerability. If CMF is not essential, disabling it can further reduce the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel is a critical component of the Linux operating system that provides core functionalities and acts as an interface between the hardware and software layers.
The scsi (Small Computer System Interface) subsystem within the Kernel enables communication with SCSI devices, such as hard drives and tape drives.
The lpfc driver is responsible for managing Fibre Channel Host Bus Adapters (HBAs) that connect the system to Fibre Channel storage networks.
Continuous Monitoring and Feedback (CMF) is a feature enabled in the lpfc driver that provides real-time monitoring and feedback on the status of Fibre Channel links.
To update the Linux Kernel, you can obtain the updated source code from the official Git repository and follow the provided instructions for building and installing the Kernel.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
