Vulnerability in Kernel package: scsi: core: Put LLD module refcnt after SCSI device is released
Summary
GSD-2021-1001990: scsi: core: Put LLD module refcnt after SCSI device is released. Affects Kernel versions < c2df161f69fb1c67f63adbd193368b47f511edc0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a crucial component of the Linux operating system. It provides the core functionality and acts as an interface between the hardware and software layers. The scsi (Small Computer System Interface) subsystem within the Kernel is responsible for managing SCSI devices, such as hard drives and tape drives. This vulnerability specifically affects the scsi core module, which is responsible for handling the core functionality of the SCSI subsystem.
Vulnerability Detail
The vulnerability in the scsi core module occurs when the module's reference count is not properly managed after a SCSI device is released. This can lead to a use-after-free condition, where the module may still be accessed even though it has been freed. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service by manipulating the freed module. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in the scsi core module of the Kernel package can potentially lead to arbitrary code execution or denial-of-service. It is recommended to update the Kernel package to version v4.19.216 or a later stable release to fix the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel package is a fundamental component of the Linux operating system, providing core functionality and acting as an interface between hardware and software layers.
The scsi core module is responsible for handling the core functionality of the SCSI subsystem in the Kernel, managing SCSI devices such as hard drives and tape drives.
A use-after-free vulnerability occurs when a program or module continues to access memory that has been freed, potentially leading to arbitrary code execution or a denial-of-service.
An attacker could potentially exploit this vulnerability by manipulating the freed scsi core module, executing arbitrary code or causing a denial-of-service.
No, the impact and attack plausibility of this vulnerability have not been proven yet.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
