Vulnerability in Kernel: scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()
Summary
GSD-2021-1002243: scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq(). Affects Kernel versions < f05a0191b90156e539cccc189b9d87ca2a4d9305. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionality and interfaces with hardware devices. It manages various system resources and facilitates communication between software and hardware components. The lpfc driver in the Kernel is responsible for handling SCSI (Small Computer System Interface) requests for Fibre Channel devices. It allows for the communication between the operating system and Fibre Channel storage devices.
Vulnerability Detail
The vulnerability identified in the lpfc driver is related to a list_add() corruption issue in the lpfc_drain_txq() function. This vulnerability could potentially be exploited by an attacker to manipulate the linked list data structure, leading to memory corruption or other unintended consequences. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in the Linux Kernel version v4.14.256 by commit f05a0191b90156e539cccc189b9d87ca2a4d9305.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
In conclusion, the vulnerability in the Kernel's lpfc driver could potentially lead to memory corruption or other unintended consequences. It is crucial to update the Linux Kernel to version v4.14.256 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is currently unknown as the attack plausibility has not been proven. However, if successfully exploited, it could lead to memory corruption or other unintended consequences.
You can use tools like Vulert (https://vulert.com) to check if your system is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software.
Yes, a patch has been released in the Linux Kernel version v4.14.256. It is recommended to update the Kernel to this version or later to fix the vulnerability.
While no specific workaround has been mentioned, it is generally recommended to keep the system and software up to date with the latest security patches and follow best practices for secure configuration.
You can refer to the official Linux Kernel documentation, security advisories, and the commit f05a0191b90156e539cccc189b9d87ca2a4d9305 for more detailed information about this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
