Out-of-Bound Read Vulnerability in scsi_debug Package
Summary
GSD-2021-1002291: scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs(). Affects Kernel versions < 8440377e1a5644779b4c8d013aa2a917f5fc83c3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The scsi_debug package is a component of the Linux Kernel ecosystem. It provides a virtual SCSI target for testing and debugging purposes. It allows users to simulate various SCSI commands and responses, aiding in the development and troubleshooting of SCSI-related functionality. However, a vulnerability has been identified in the package that could potentially lead to an out-of-bound read.
Vulnerability Detail
The vulnerability, identified as GSD-2021-1002291, exists in the resp_report_tgtpgs() function of the scsi_debug package. It is caused by an out-of-bound read, which occurs when the function attempts to access memory beyond the allocated buffer. This vulnerability could be exploited by an attacker to read sensitive information from kernel memory or cause a denial-of-service condition. It is important to note that the impact and attack plausibility of this vulnerability have not been proven.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
In conclusion, the scsi_debug package in the Linux Kernel is vulnerable to an out-of-bound read issue in the resp_report_tgtpgs() function. It is crucial to update the Linux Kernel to version v5.10.82 or a later version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The scsi_debug package is a component of the Linux Kernel ecosystem that provides a virtual SCSI target for testing and debugging purposes.
The impact of this vulnerability could potentially include unauthorized access to sensitive information or a denial-of-service condition.
No, the impact and attack plausibility of this vulnerability have not been proven.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.10.82 or a later version that includes the fix.
No specific workaround has been mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
