Vulnerability in scsi: core package - Bad Pointer Dereference
Summary
GSD-2021-1001343: scsi: core: Fix bad pointer dereference when ehandler kthread is invalid. Affects Kernel versions >= 79296e292d67fa7b5fb8d8c27343683e823872c8, < 887bfae2732b5b02a86a859fd239d34f7ff93c05. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The scsi: core package is a component of the Linux Kernel, which is responsible for managing SCSI (Small Computer System Interface) devices. It provides the necessary functionality for communication between the operating system and SCSI devices, such as hard drives, tape drives, and optical drives. The scsi: core package plays a crucial role in ensuring the proper functioning of SCSI devices and their integration with the Linux operating system.
Vulnerability Detail
The identified vulnerability in the scsi: core package involves a bad pointer dereference when the ehandler kthread (kernel thread) is invalid. This vulnerability can potentially be exploited by an attacker to cause a denial-of-service (DoS) condition or execute arbitrary code with kernel privileges. The vulnerability was introduced in version v5.4.126 of the Linux Kernel and has been fixed in version v5.4.134.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the affected functionality by unloading the scsi_mod kernel module. This can be achieved by running the following command as root:
rmmod scsi_mod
However, it is important to note that this workaround will result in the loss of SCSI device support until the vulnerability is properly fixed.
Conclusion
In conclusion, the scsi: core package in the Linux Kernel is vulnerable to a bad pointer dereference issue. This vulnerability can be mitigated by updating the kernel to version v5.4.134 or later. Alternatively, users can temporarily disable the affected functionality, but this will result in the loss of SCSI device support. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The scsi: core package is a component of the Linux Kernel that handles the communication between the operating system and SCSI devices.
A bad pointer dereference occurs when a program or kernel attempts to access memory using an invalid pointer, leading to unexpected behavior or crashes.
This vulnerability can be exploited by an attacker to cause a denial-of-service (DoS) condition or execute arbitrary code with kernel privileges.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.4.134 or later.
Yes, users can disable the affected functionality by unloading the scsi_mod kernel module. However, this will result in the loss of SCSI device support.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
