Vulnerability in Kernel: scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()
Summary
GSD-2021-1002348: scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq(). Affects Kernel versions < 814d3610c4ce86e8cf285b2cdac0057a42e82de5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a fundamental component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It provides essential functionalities such as process management, memory management, and device drivers. The lpfc driver in the Kernel is used for Fibre Channel over Ethernet (FCoE) support. It enables communication between Fibre Channel storage devices and Ethernet networks. However, a vulnerability has been discovered in the lpfc driver that could lead to list_add() corruption in the lpfc_drain_txq() function.
Vulnerability Detail
The vulnerability in the lpfc driver arises from a list_add() corruption issue in the lpfc_drain_txq() function. This vulnerability could potentially be exploited by an attacker to cause a denial-of-service (DoS) condition or execute arbitrary code with kernel privileges. The list_add() corruption can result in memory corruption and subsequent system instability. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in the Linux Kernel version v5.15.5 by commit 814d3610c4ce86e8cf285b2cdac0057a42e82de5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to update the Kernel to the fixed version.
Conclusion
In conclusion, a vulnerability has been identified in the lpfc driver of the Kernel, which could lead to list_add() corruption in the lpfc_drain_txq() function. This vulnerability has the potential to cause a denial-of-service (DoS) condition or enable arbitrary code execution with kernel privileges. It is crucial to update the Kernel to version v5.15.5 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel is a fundamental component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software.
The lpfc driver is used for Fibre Channel over Ethernet (FCoE) support in the Kernel. It enables communication between Fibre Channel storage devices and Ethernet networks.
The impact of this vulnerability could range from a denial-of-service (DoS) condition to arbitrary code execution with kernel privileges. However, the actual impact and attack plausibility have not been proven yet.
To fix this vulnerability, it is recommended to update the Kernel to version v5.15.5 or later. Instructions for updating the Kernel can be found in the official Linux Kernel repository.
No specific workaround has been mentioned for this vulnerability. Updating the Kernel to the fixed version is the recommended approach.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
