net/qla3xxx: Fix schedule while atomic in ql_sem_spinlock
Summary
GSD-2021-1000854: net/qla3xxx: fix schedule while atomic in ql_sem_spinlock. Affects Kernel versions < b0b447bcdeda85fa66782ee8ea1758d55eeec224. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net/qla3xxx package is a part of the Linux Kernel ecosystem. It provides support for QLogic Fibre Channel Host Bus Adapters (HBAs). These HBAs enable communication between servers and storage devices over Fibre Channel networks. The ql_sem_spinlock function in the qla3xxx package is responsible for acquiring and releasing a spinlock to protect critical sections of code.
Vulnerability Detail
The vulnerability in the ql_sem_spinlock function allows for a schedule while atomic condition, which can lead to a deadlock situation. This occurs when a process tries to acquire a spinlock while already holding another spinlock, causing the process to be stuck indefinitely. An attacker could potentially exploit this vulnerability to cause a denial-of-service (DoS) condition or disrupt the normal operation of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The net/qla3xxx package in the Linux Kernel is vulnerable to a schedule while atomic condition in the ql_sem_spinlock function. This can lead to a deadlock situation and potential denial-of-service (DoS) attacks. It is recommended to update the Linux Kernel to version v4.14.237 or later to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a deadlock situation, potentially causing a denial-of-service (DoS) condition or disrupting the normal operation of the system.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Yes, the vulnerability is fixed in Linux Kernel version v4.14.237 by commit b0b447bcdeda85fa66782ee8ea1758d55eeec224. Updating to this version will address the issue.
There are no known exploits for this vulnerability at the time of this report.
You can refer to the vulnerability details in the GSD database: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1000xxx/GSD-2021-1000854.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
