Memory Leak in qla2xxx Driver in Linux Kernel
Summary
GSD-2021-1001865: scsi: qla2xxx: Fix a memory leak in an error path of qla2x00_process_els(). Affects Kernel versions >= 8c0eb596baa51f2b43949c698c644727ef17805c, < a7fbb56e6c941d9f59437b96412a348e66388d3e. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The qla2xxx driver is a SCSI driver used in the Linux Kernel. It provides support for QLogic Fibre Channel Host Bus Adapters (HBAs). These HBAs are commonly used in enterprise storage systems. The driver allows communication between the operating system and the QLogic HBAs, enabling the system to access storage devices connected to the HBAs.
Vulnerability Detail
The qla2xxx driver in the Linux Kernel is vulnerable to a memory leak in an error path of the qla2x00_process_els() function. This vulnerability can be triggered when processing Extended Link Services (ELS) messages. An attacker could exploit this vulnerability to cause a memory leak, potentially leading to resource exhaustion and system instability. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability at this time.
Conclusion
The qla2xxx driver in the Linux Kernel is vulnerable to a memory leak issue. To mitigate this vulnerability, it is recommended to update the Kernel to the latest version. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The qla2xxx driver is a SCSI driver used in the Linux Kernel to provide support for QLogic Fibre Channel Host Bus Adapters (HBAs). These HBAs are commonly used in enterprise storage systems.
The vulnerability can lead to a memory leak in the qla2xxx driver, potentially causing resource exhaustion and system instability.
An attacker could exploit this vulnerability by sending specially crafted Extended Link Services (ELS) messages to the system.
No, the impact and attack plausibility of this vulnerability have not been proven yet.
To fix this vulnerability, update the Linux Kernel to version v5.14.15 or later.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
