Vulnerability in Kernel package: scsi: pm8001: Fix abort all task initialization
Summary
GSD-2022-1001221: scsi: pm8001: Fix abort all task initialization. Affects Kernel versions >= c6b9ef5779c3e1edfa9de949d2a51252bc347663, < 16cd02e0951b520bef324adb9a35afcc92501caf. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a crucial component of the Linux operating system, responsible for managing the system's core functions and providing an interface between hardware and software. It includes various subsystems, such as the scsi (Small Computer System Interface) module, which handles communication with SCSI devices. One specific module within scsi is pm8001, which is used for managing SAS (Serial Attached SCSI) host bus adapters.
The vulnerability in question relates to the initialization of abort all tasks in the pm8001 module. This vulnerability was introduced in version v3.10 of the Linux Kernel by commit c6b9ef5779c3e1edfa9de949d2a51252bc347663 and has been present until version v5.17.2, where it was fixed by commit 16cd02e0951b520bef324adb9a35afcc92501caf.
Vulnerability Detail
The vulnerability arises from a flaw in the abort all task initialization process within the pm8001 module. It could potentially allow an attacker to exploit this flaw and cause a denial-of-service (DoS) condition or execute arbitrary code on a vulnerable system. The exact impact and attack plausibility have not been proven yet.
To exploit this vulnerability, an attacker would need to have local access to a system with a vulnerable version of the Linux Kernel and the pm8001 module loaded. They could then craft a malicious payload to trigger the flaw during the abort all task initialization process, leading to the potential consequences mentioned above.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, the Kernel package in Linux, specifically the scsi: pm8001 module, was found to have a vulnerability related to the abort all task initialization process. This flaw could potentially lead to a denial-of-service (DoS) condition or arbitrary code execution. It is crucial to update the Linux Kernel to version v5.17.2 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability could potentially lead to a denial-of-service (DoS) condition or allow an attacker to execute arbitrary code on a vulnerable system. However, the exact impact and attack plausibility have not been proven yet.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) to the playground, and it will provide real-time monitoring and alerts for open-source vulnerabilities, including this one.
No specific workaround has been provided for this vulnerability. It is recommended to update the Linux Kernel to the fixed version (v5.17.2 or later) to mitigate the risk.
No, this vulnerability requires local access to a system with a vulnerable version of the Linux Kernel and the pm8001 module loaded. Remote exploitation is not possible.
There are no known instances of this vulnerability being exploited in the wild at this time.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
