Vulnerability in Kernel package: scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe
Summary
GSD-2022-1000142: scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe. Affects Kernel versions >= d576a5e80cd07ea7049f8fd7b303c14df7b5d7d2, < 003bcee66a8f0e76157eb3af369c173151901d97. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system, responsible for managing the system's core functionality. It provides an interface between the hardware and software layers, allowing applications to communicate with the underlying hardware. The scsi subsystem within the Kernel package handles SCSI (Small Computer System Interface) commands and manages storage devices. The bnx2fc module is a SCSI driver for Broadcom NetXtreme II Fibre Channel adapters. It enables communication between the Linux system and Fibre Channel storage devices. However, a vulnerability has been discovered in the bnx2fc_recv_frame() function, which can potentially be exploited by attackers.
Vulnerability Detail
The vulnerability in the bnx2fc_recv_frame() function of the bnx2fc module allows for a potential security breach. The function is not multi-processor (mp) safe, meaning that concurrent execution of the function by multiple processors can lead to race conditions and memory corruption. An attacker could exploit this vulnerability to execute arbitrary code, escalate privileges, or cause a denial-of-service (DoS) condition. The impact and attack plausibility of this vulnerability have not yet been proven.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the bnx2fc module if it is not required for their system's operation. This can be achieved by blacklisting the module or preventing it from loading during system startup. However, disabling the module may impact the functionality of Fibre Channel storage devices, so it is recommended to update the Kernel package instead.
Conclusion
The vulnerability in the bnx2fc_recv_frame() function of the Kernel package can pose a significant security risk. It is crucial to update the Kernel package to the recommended version or apply the provided workaround to mitigate the vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel package is a critical component of the Linux operating system, responsible for managing the system's core functionality.
The bnx2fc module is a SCSI driver for Broadcom NetXtreme II Fibre Channel adapters, enabling communication between the Linux system and Fibre Channel storage devices.
The impact of this vulnerability can include arbitrary code execution, privilege escalation, or denial-of-service (DoS) conditions.
To fix this vulnerability, update the Linux Kernel package to version v4.19.228 or later.
Yes, users can disable the bnx2fc module if it is not required for their system's operation. However, it is recommended to update the Kernel package instead.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
