Vulnerability in Kernel package: scsi: bnx2fc
Summary
GSD-2022-1000195: scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put(). Affects Kernel versions >= 0cbf32e1681d870632a1772601cbaadd996dc978, < 00849de10f798a9538242824a51b1756e7110754. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is an essential component of the Linux operating system, responsible for managing the system's core functionality. It provides an interface between the hardware and software layers, allowing applications to communicate with the underlying hardware. The scsi: bnx2fc module within the Kernel package is specifically designed for Fibre Channel over Ethernet (FCoE) support. It enables the use of FCoE adapters to connect storage devices to the system. However, a vulnerability has been discovered in the scsi: bnx2fc module that could potentially be exploited by malicious actors.
Vulnerability Detail
The vulnerability in the scsi: bnx2fc module arises from a failure to flush the destroy_work queue before calling bnx2fc_interface_put(). This flaw could lead to a use-after-free condition, where a reference to freed memory is still accessible, potentially allowing an attacker to execute arbitrary code or cause a denial-of-service (DoS) situation. The impact and attack plausibility of this vulnerability have not been proven yet. The vulnerability was introduced in version v3.2 of the Linux Kernel and has been fixed in version v5.10.96 by commit 00849de10f798a9538242824a51b1756e7110754.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability. It is advised to apply the fix by updating the Kernel package to the latest version.
Conclusion
In conclusion, the scsi: bnx2fc module in the Kernel package has a vulnerability that could potentially be exploited to execute arbitrary code or cause a denial-of-service situation. It is crucial to update the Kernel package to version v5.10.96 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The scsi: bnx2fc module is a component of the Linux Kernel package that provides support for Fibre Channel over Ethernet (FCoE). It allows the use of FCoE adapters to connect storage devices to the system.
A use-after-free vulnerability occurs when a program continues to reference memory after it has been freed. This can lead to unpredictable behavior and potential security issues if an attacker can manipulate the freed memory.
If exploited, this vulnerability could allow an attacker to execute arbitrary code or cause a denial-of-service (DoS) situation. However, the actual impact and attack plausibility have not been proven yet.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
For more details about this vulnerability, you can refer to the vulnerability database entry at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1000xxx/GSD-2022-1000195.json.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
