Vulnerability in Kernel: scsi: sg: Allow waiting for commands to complete on removed device
Summary
GSD-2022-1005670: scsi: sg: Allow waiting for commands to complete on removed device. Affects Kernel versions < 8c004b7dbb340c1e5889f5fb9e5baa6f6e5303e8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages communication between hardware and software. It provides essential functions and services for the system to operate efficiently. One of its functionalities is handling SCSI (Small Computer System Interface) devices, which are commonly used for storage and other peripheral devices. The scsi-sg driver in the Kernel allows user-level applications to send SCSI commands directly to devices. However, a vulnerability has been discovered in this driver that allows waiting for commands to complete on a removed device, leading to potential security risks.
Vulnerability Detail
The vulnerability in the scsi-sg driver allows an attacker to exploit the ability to wait for commands to complete on a removed device. By sending specially crafted commands to a removed SCSI device, an attacker can potentially execute arbitrary code or trigger a denial-of-service condition. This vulnerability can be exploited remotely if the affected system is exposed to the internet. It is important to note that the impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is currently no known workaround for this vulnerability. It is highly recommended to apply the official fix by updating the Linux Kernel.
Conclusion
The vulnerability in the scsi-sg driver of the Linux Kernel allows waiting for commands to complete on a removed device, potentially leading to arbitrary code execution or denial-of-service. It is crucial to update the Linux Kernel to version v5.15.61 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The scsi-sg driver is a component of the Linux Kernel that allows user-level applications to send SCSI commands directly to devices. It provides a way to interact with SCSI devices at a low level.
If exploited, this vulnerability can allow an attacker to execute arbitrary code or cause a denial-of-service condition on the affected system. The impact and attack plausibility of this vulnerability have not been proven yet.
Yes, this vulnerability can be exploited remotely if the affected system is exposed to the internet.
Yes, this vulnerability has been fixed in Linux Kernel version v5.15.61 by commit 8c004b7dbb340c1e5889f5fb9e5baa6f6e5303e8.
There is currently no known workaround for this vulnerability. It is recommended to update the Linux Kernel to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
