Vulnerability in Kernel: Put LLD module refcnt after SCSI device is released
Summary
GSD-2021-1002070: scsi: core: Put LLD module refcnt after SCSI device is released. Affects Kernel versions < 7b57c38d12aed1b5d92f74748bed25e0d041729f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionality and interfaces with hardware devices. It manages the communication between the operating system and the computer's hardware, including storage devices. The SCSI (Small Computer System Interface) subsystem is responsible for handling SCSI devices, such as hard drives and tape drives. This vulnerability in the Kernel's SCSI core module could potentially lead to security issues.
Vulnerability Detail
The vulnerability arises from a flaw in the SCSI core module of the Kernel. Specifically, the module fails to properly release the reference count of the Low-Level Driver (LLD) after a SCSI device is released. This can result in a use-after-free condition, where an attacker could potentially exploit the freed memory to execute arbitrary code or cause a denial-of-service (DoS) condition. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in the Kernel's SCSI core module has the potential to be exploited by attackers to execute arbitrary code or cause a denial-of-service (DoS) condition. It is crucial to update the Kernel to the latest version, v5.10.78 or later, to mitigate this vulnerability. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability could potentially allow an attacker to execute arbitrary code or cause a denial-of-service (DoS) condition.
You can use Vulert's playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your manifest file, such as package-lock.json, and Vulert will analyze it for any open-source vulnerabilities, including this one.
There is no information available regarding the exploitation of this vulnerability in the wild at the moment.
The vulnerability is present in versions of the Kernel prior to v5.10.78. It has been fixed in this version and subsequent releases.
For more details about this vulnerability, including the specific code changes that address it, you can refer to the source link provided in the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
