Vulnerability in Kernel: scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()
Summary
GSD-2021-1002274: scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq(). Affects Kernel versions < 16bcbfb56d759c25665f786e33ec633b9508a08f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionality and interfaces with hardware devices. It manages system resources, facilitates communication between software and hardware, and enables the execution of user programs. The lpfc (LightPulse Fibre Channel) driver is responsible for handling Fibre Channel storage devices. It allows the system to communicate with Fibre Channel storage arrays and perform operations such as reading and writing data. However, a vulnerability has been discovered in the lpfc driver that could lead to list_add() corruption in the lpfc_drain_txq() function.
Vulnerability Detail
The vulnerability in the lpfc driver arises from a list_add() corruption issue in the lpfc_drain_txq() function. This vulnerability could potentially be exploited by an attacker to manipulate the linked list data structure, leading to various consequences such as memory corruption, system crashes, or even arbitrary code execution. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in the Linux Kernel version v5.4.162 by commit 16bcbfb56d759c25665f786e33ec633b9508a08f.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to apply the fix by updating the Linux Kernel to the patched version.
Conclusion
In conclusion, a vulnerability has been discovered in the lpfc driver of the Linux Kernel, which could result in list_add() corruption. It is crucial to update the Kernel to version v5.4.162 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel is a critical component of the Linux operating system that provides core functionality and interfaces with hardware devices.
The lpfc (LightPulse Fibre Channel) driver is responsible for handling Fibre Channel storage devices in the Linux Kernel.
list_add() corruption refers to a situation where the integrity of a linked list data structure is compromised, potentially leading to various issues such as memory corruption or system crashes.
The potential consequences of this vulnerability include memory corruption, system crashes, or even arbitrary code execution.
Yes, this vulnerability has been fixed in the Linux Kernel version v5.4.162 by commit 16bcbfb56d759c25665f786e33ec633b9508a08f.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
