Memory Leak in qla2xxx Driver in Linux Kernel
Summary
GSD-2021-1002116: scsi: qla2xxx: Fix a memory leak in an error path of qla2x00_process_els(). Affects Kernel versions >= 8c0eb596baa51f2b43949c698c644727ef17805c, < a7fbb56e6c941d9f59437b96412a348e66388d3e. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The qla2xxx driver is a SCSI driver in the Linux Kernel that provides support for QLogic Fibre Channel Host Bus Adapters (HBAs). These HBAs are commonly used in enterprise storage systems. The driver allows communication between the operating system and the Fibre Channel HBA, enabling the system to access storage devices connected to the HBA. However, a vulnerability has been discovered in the qla2xxx driver that can lead to a memory leak in certain error scenarios.
Vulnerability Detail
The vulnerability in the qla2xxx driver occurs in the error path of the qla2x00_process_els() function. When processing certain Event Log Status (ELS) frames, if an error is encountered, the function fails to release allocated memory, resulting in a memory leak. An attacker could potentially exploit this vulnerability by sending specially crafted ELS frames to a system with a vulnerable qla2xxx driver. This could lead to a gradual depletion of system memory, eventually causing system instability or denial of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the qla2xxx driver if it is not essential for their system's operation. This can be achieved by blacklisting the driver module or removing it from the kernel configuration. However, this workaround should only be considered if the qla2xxx driver is not required for critical system functionality.
Conclusion
The memory leak vulnerability in the qla2xxx driver can have serious consequences for system stability and availability. It is crucial to update the Linux Kernel to version v5.14.15 or later to mitigate this vulnerability. Users can obtain the updated kernel from the official Linux Kernel repository or through their Linux distribution's package management system. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can result in a memory leak, leading to gradual depletion of system memory. This can cause system instability or denial of service.
An attacker can exploit this vulnerability by sending specially crafted Event Log Status (ELS) frames to a system with a vulnerable qla2xxx driver.
Systems running the Linux Kernel with the qla2xxx driver version v3.11 to v5.14.14 are affected by this vulnerability.
Yes, the vulnerability has been fixed in Linux Kernel version v5.14.15. Users are advised to update their kernel to this version or later.
A temporary workaround is to disable the qla2xxx driver if it is not essential for the system's operation. This can be achieved by blacklisting the driver module or removing it from the kernel configuration.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
