Vulnerability in Kernel Package: scsi: core: Fix bad pointer dereference when ehandler kthread is invalid
Summary
GSD-2021-1001386: scsi: core: Fix bad pointer dereference when ehandler kthread is invalid. Affects Kernel versions >= 2dc85045ae65b9302a1d2e2ddd7ce4c030153a6a, < e1bd3fac2baa3d5c04375980c1d5263a3335af92. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system that provides the core functionality and interfaces between the hardware and software layers. It includes various subsystems, such as the scsi (Small Computer System Interface) core, which handles communication with SCSI devices. The scsi core is responsible for managing the SCSI command execution and error handling. However, a vulnerability has been discovered in the scsi core related to a bad pointer dereference when the error handler (ehandler) kernel thread is invalid.
Vulnerability Detail
The vulnerability arises from a bad pointer dereference in the scsi core when the ehandler kernel thread is invalid. This issue can be exploited by an attacker to cause a denial-of-service (DoS) condition or potentially execute arbitrary code with kernel privileges. The vulnerability was introduced in version v4.19.195 of the Linux Kernel and is fixed in version v4.19.198 by commit e1bd3fac2baa3d5c04375980c1d5263a3335af92.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the Kernel package to the fixed version as mentioned in the 'how_to_fix' section.
Conclusion
In conclusion, a vulnerability has been identified in the Kernel package, specifically in the scsi core, which can result in a denial-of-service (DoS) condition or potential execution of arbitrary code with kernel privileges. It is crucial to update the Kernel package to version v4.19.198 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a denial-of-service (DoS) condition or potential execution of arbitrary code with kernel privileges.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and it will provide real-time monitoring and alerts for open-source vulnerabilities.
At the time of this report, there is no known public exploit for this vulnerability. However, it is crucial to apply the fix as soon as possible to mitigate any potential risks.
Yes, this vulnerability can be exploited remotely if the attacker can gain access to the affected system.
No specific prerequisites are required to exploit this vulnerability. However, the attacker needs to have the ability to execute malicious code on the target system.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
