Vulnerability in Kernel package: scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe
Summary
GSD-2022-1000591: scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe. Affects Kernel versions >= d576a5e80cd07ea7049f8fd7b303c14df7b5d7d2, < 2f5a1ac68bdf2899ce822ab845081922ea8c588e. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a fundamental component of the Linux operating system, responsible for managing the system's core functionality. It provides an interface between the hardware and software layers, allowing applications to interact with the underlying system resources. The scsi subsystem within the Kernel package handles communication with SCSI devices, enabling data transfer between the system and storage devices. One of the components in the scsi subsystem is bnx2fc, which is responsible for handling Fibre Channel over Ethernet (FCoE) traffic. The bnx2fc_recv_frame() function within bnx2fc is used to receive frames from the network. However, this function has a vulnerability that can be exploited by attackers.
Vulnerability Detail
The vulnerability in the bnx2fc_recv_frame() function allows for a potential security breach. It was introduced in version v3.16 of the Linux Kernel by commit d576a5e80cd07ea7049f8fd7b303c14df7b5d7d2 and is fixed in version v5.15.22 by commit 2f5a1ac68bdf2899ce822ab845081922ea8c588e. The impact and attack plausibility of this vulnerability have not been proven yet. However, if successfully exploited, it could lead to unauthorized access, data leakage, or denial of service. The vulnerability arises due to a lack of proper handling of concurrent execution in the bnx2fc_recv_frame() function.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, if updating the Kernel package is not immediately feasible, it is recommended to restrict access to the vulnerable function by applying appropriate access controls or firewall rules. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
The vulnerability in the Kernel package's bnx2fc_recv_frame() function poses a potential security risk. It is crucial to update the package to the fixed version to mitigate the vulnerability. For further support and assistance in vulnerability remediation, please reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel package is a crucial component of the Linux operating system that manages the core functionality and acts as an interface between hardware and software layers.
The scsi subsystem in the Kernel package handles communication with SCSI devices, facilitating data transfer between the system and storage devices.
bnx2fc is a component within the scsi subsystem that handles Fibre Channel over Ethernet (FCoE) traffic.
The bnx2fc_recv_frame() function is responsible for receiving frames from the network within the bnx2fc component.
To fix this vulnerability, update the Kernel package to version v5.15.22 or later by pulling the latest changes from the official Linux Kernel repository and following the installation process.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
