Vulnerability in Kernel package: scsi: ibmvfc: Store vhost pointer during subcrq allocation
Summary
GSD-2022-1004281: scsi: ibmvfc: Store vhost pointer during subcrq allocation. Affects Kernel versions >= 3034ebe26389740bb6b4a463e05afb51dc93c336, < 6d38e3b614ded59da8b95377a98df969a5a5627a. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Kernel package is a critical component of the Linux operating system, responsible for managing the system's core functionality. It provides an interface between the hardware and software layers, allowing applications to communicate with the underlying hardware. The scsi: ibmvfc module within the Kernel package is specifically designed for IBM Power Systems Virtualization First Class (VFC) SCSI devices. It enables communication between the virtual host and the storage devices. However, a vulnerability has been identified in this module that could potentially lead to security issues.
Vulnerability Detail
The vulnerability in the scsi: ibmvfc module arises from a failure to store the vhost pointer during subcrq (subchannel request) allocation. This oversight could allow an attacker to manipulate the vhost pointer, potentially leading to memory corruption or other security exploits. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in the Linux Kernel version v5.18.8 by commit 6d38e3b614ded59da8b95377a98df969a5a5627a. However, it was introduced in version v5.12 by commit 3034ebe26389740bb6b4a463e05afb51dc93c336.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
The vulnerability in the scsi: ibmvfc module of the Kernel package has the potential to cause security issues. It is crucial to update the Kernel package to version v5.18.8 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel package is a critical component of the Linux operating system, responsible for managing the system's core functionality.
The scsi: ibmvfc module is a component within the Kernel package that enables communication between virtual hosts and storage devices in IBM Power Systems Virtualization First Class (VFC) SCSI devices.
The impact of this vulnerability is not yet proven. However, if exploited, it could potentially lead to memory corruption or other security exploits.
To fix this vulnerability, update the Kernel package to version v5.18.8 or later.
Yes, this vulnerability has been fixed in the Linux Kernel version v5.18.8 by commit 6d38e3b614ded59da8b95377a98df969a5a5627a.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
