Vulnerability in Kernel package: scsi: qedf: Fix refcount issue when LOGO is received during TMF
Summary
GSD-2022-1000334: scsi: qedf: Fix refcount issue when LOGO is received during TMF. Affects Kernel versions < 7cc32ff0cd6c44a3c26de5faecfe8b5546198fad. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a fundamental component of the Linux operating system, responsible for managing the system's core functions and providing an interface between hardware and software. It includes various subsystems, such as the scsi (Small Computer System Interface) subsystem, which handles communication with SCSI devices. The scsi: qedf module within the Kernel package specifically deals with the QLogic Enhanced Disk Format (qedf) driver, used for Fibre Channel over Ethernet (FCoE) storage connectivity. This vulnerability affects the qedf module when a LOGO (Logout) command is received during a Target Mode Function (TMF) operation.
Vulnerability Detail
The vulnerability in the scsi: qedf module arises from a refcount issue when a LOGO command is received during a TMF operation. This issue could potentially lead to a use-after-free scenario, where a reference to freed memory is still accessible. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition. The vulnerability has been assigned the ID GSD-2022-1000334 and has been fixed in Linux Kernel version v5.4.180 by commit 7cc32ff0cd6c44a3c26de5faecfe8b5546198fad.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, the scsi: qedf module in the Kernel package is vulnerable to a refcount issue when a LOGO command is received during a TMF operation. This vulnerability can be mitigated by updating the Kernel package to version v5.4.180 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability could allow an attacker to execute arbitrary code or cause a denial-of-service condition.
No, updating the Kernel package to the fixed version is the recommended solution.
The vulnerability affects versions prior to v5.4.180 of the Linux Kernel package.
There is no information available regarding exploitation of this vulnerability in the wild.
You can find more information about this vulnerability in the GSD-2022-1000334 entry of the GSD database: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1000xxx/GSD-2022-1000334.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
