Vulnerability in Kernel: scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()
Summary
GSD-2021-1002255: scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq(). Affects Kernel versions < b291d147d0268e93ad866f8bc820ea14497abc9b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionality and interfaces with hardware devices. It manages system resources, facilitates communication between software and hardware, and enables the execution of user programs. The lpfc driver in the Kernel is responsible for handling SCSI (Small Computer System Interface) commands for Fibre Channel storage devices. It allows the system to communicate with storage devices over a Fibre Channel network. However, a vulnerability has been discovered in the lpfc driver that can lead to list_add() corruption in the lpfc_drain_txq() function.
Vulnerability Detail
The vulnerability in the lpfc driver arises from a list_add() corruption issue in the lpfc_drain_txq() function. This vulnerability could potentially be exploited by an attacker to manipulate the linked list used by the driver, leading to various consequences such as memory corruption, system crashes, or privilege escalation. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in Linux Kernel version v4.19.218 by commit b291d147d0268e93ad866f8bc820ea14497abc9b.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to apply the fix by updating the Linux Kernel to the patched version.
Conclusion
In conclusion, a vulnerability has been identified in the lpfc driver of the Kernel, which could lead to list_add() corruption. It is recommended to update the Linux Kernel to version v4.19.218 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel is a critical component of the Linux operating system that provides core functionality and interfaces with hardware devices.
The lpfc driver is responsible for handling SCSI commands for Fibre Channel storage devices in the Linux Kernel.
List_add() corruption refers to a situation where the integrity of a linked list data structure is compromised, potentially leading to unexpected behavior or vulnerabilities.
The potential consequences of this vulnerability include memory corruption, system crashes, or privilege escalation.
Yes, this vulnerability has been fixed in Linux Kernel version v4.19.218 by commit b291d147d0268e93ad866f8bc820ea14497abc9b.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
