Vulnerability in Kernel package: scsi: core: Put LLD module refcnt after SCSI device is released
Summary
GSD-2021-1001946: scsi: core: Put LLD module refcnt after SCSI device is released. Affects Kernel versions < 8e4814a461787e15a31d322d9efbe0d4f6822428. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a crucial component of the Linux operating system that provides the core functionality and interfaces for various hardware devices and software components. It includes drivers, protocols, and other essential modules to enable communication between the operating system and hardware devices. One of the components in the Kernel package is the scsi (Small Computer System Interface) core, which handles SCSI devices and their interactions.
The scsi core module manages the lifecycle of SCSI devices, including their initialization, configuration, and release. It also interacts with the Low-Level Drivers (LLD) responsible for handling specific SCSI devices. The LLD modules are loaded dynamically when a SCSI device is detected.
However, a vulnerability has been identified in the scsi core module, specifically in the handling of LLD module reference counting. The reference counting mechanism is used to track the number of references to a module, ensuring that it is not unloaded prematurely. In this case, the LLD module reference count is not properly decremented after the SCSI device is released, potentially leading to a use-after-free vulnerability.
This vulnerability could be exploited by an attacker to execute arbitrary code or cause a denial-of-service condition on a vulnerable system.
Vulnerability Detail
The vulnerability in the scsi core module arises from the improper handling of LLD module reference counting. When a SCSI device is released, the reference count for the associated LLD module should be decremented. However, due to a coding error, this decrement operation is not performed, leaving the reference count unchanged.
As a result, if the LLD module is subsequently unloaded while there are still references to it, a use-after-free condition can occur. An attacker could potentially exploit this vulnerability by carefully manipulating the system to trigger the use-after-free condition and execute arbitrary code or disrupt the normal operation of the system.
It is important to note that the impact and attack plausibility of this vulnerability have not been proven yet, but it is still considered a potential security risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply the patch manually to their existing Kernel package if updating to the fixed version is not immediately feasible. The patch can be obtained from the commit 8e4814a461787e15a31d322d9efbe0d4f6822428 in the Linux Kernel repository.
To apply the patch, follow these steps:
- Download the patch file from the commit mentioned above.
- Navigate to the directory containing the Kernel source code on your system.
- Apply the patch using the
patchcommand, specifying the path to the patch file. - Recompile and reinstall the Kernel package following the instructions provided with the source code.
- Reboot your system to ensure the patched Kernel package is loaded and the vulnerability is mitigated.
Conclusion
The vulnerability in the scsi core module of the Kernel package poses a potential security risk due to the improper handling of LLD module reference counting. To mitigate this vulnerability, it is recommended to update the Kernel package to version v4.9.290 or a later version that includes the fix. Alternatively, users can apply the provided patch manually as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The scsi core module is a component of the Kernel package that handles SCSI devices and their interactions. It provides the necessary functionality and interfaces for SCSI device initialization, configuration, and release.
An LLD module, or Low-Level Driver module, is a specific driver module responsible for handling a particular type of SCSI device. It is dynamically loaded by the scsi core module when a compatible SCSI device is detected.
Reference counting is a mechanism used to track the number of references to a particular resource, such as a module. It ensures that the resource is not unloaded or deallocated prematurely while there are still active references to it.
A use-after-free vulnerability occurs when a program or system continues to use a resource after it has been freed or deallocated. In this case, the use-after-free vulnerability arises from the improper handling of LLD module reference counting, potentially leading to the use of a module that has already been unloaded.
This vulnerability could be exploited by an attacker who carefully manipulates the system to trigger the use-after-free condition. By exploiting this vulnerability, an attacker could execute arbitrary code or disrupt the normal operation of the system.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
