Vulnerability in Kernel package: scsi: core: Put LLD module refcnt after SCSI device is released
Summary
GSD-2021-1001926: scsi: core: Put LLD module refcnt after SCSI device is released. Affects Kernel versions < 1105573d964f7b78734348466b01f5f6ba8a1813. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system. It provides the core functionality and interfaces for various hardware devices, including storage devices. The scsi (Small Computer System Interface) subsystem within the Kernel handles communication with SCSI devices such as hard drives, tape drives, and optical drives. This vulnerability specifically affects the scsi core module, which is responsible for managing the overall SCSI functionality in the Kernel.
Vulnerability Detail
The vulnerability identified as GSD-2021-1001926 in the scsi core module of the Kernel package allows for a potential security breach. When a SCSI device is released, the module fails to properly handle the reference count of the Low-Level Driver (LLD) module associated with the device. This can lead to a use-after-free scenario, where an attacker could exploit the freed memory to execute arbitrary code or cause a denial-of-service (DoS) condition. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, applying the recommended fix by updating the Kernel package to the latest version is the best course of action.
Conclusion
The vulnerability in the scsi core module of the Kernel package poses a potential security risk due to improper handling of the LLD module reference count. To mitigate this vulnerability, it is crucial to update the Linux Kernel package to version v4.4.292 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel package is a critical component of the Linux operating system, providing core functionality and interfaces for various hardware devices.
The scsi core module is responsible for managing the overall SCSI functionality in the Linux Kernel, including communication with SCSI devices.
A use-after-free vulnerability occurs when a program continues to use memory after it has been freed, potentially leading to arbitrary code execution or a DoS condition.
To fix this vulnerability, update the Linux Kernel package to version v4.4.292 or later, which includes the necessary fix for proper handling of the LLD module reference count.
No specific workaround is mentioned for this vulnerability. Updating the Kernel package to the latest version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
