Vulnerability in Kernel package: scsi: pm8001: Fix task leak in pm8001_send_abort_all()
Summary
GSD-2022-1001398: scsi: pm8001: Fix task leak in pm8001_send_abort_all(). Affects Kernel versions < 146cae06d2682d7563732544be334e8e6d3862b8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system, responsible for managing the system's core functionality. It provides an interface between the hardware and software layers, allowing applications to communicate with the underlying hardware. The scsi subsystem within the Kernel package handles communication with SCSI (Small Computer System Interface) devices, such as hard drives and tape drives. One specific component of the scsi subsystem is the pm8001 driver, which is responsible for managing SAS (Serial Attached SCSI) host bus adapters based on the PM8001 chipset. The pm8001_send_abort_all() function within the pm8001 driver is vulnerable to a task leak, which can lead to resource exhaustion and potential system instability.
Vulnerability Detail
The vulnerability in the pm8001_send_abort_all() function of the pm8001 driver allows for a task leak. This means that when aborting all outstanding tasks, the function fails to properly release the associated resources, resulting in a gradual depletion of system resources over time. An attacker could exploit this vulnerability by repeatedly triggering the abort operation, leading to resource exhaustion and potentially causing the system to become unstable or unresponsive. The impact of this vulnerability depends on the specific usage scenario and the availability of resources on the affected system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by updating the Kernel package to the latest version.
Conclusion
In conclusion, the Kernel package is vulnerable to a task leak in the pm8001_send_abort_all() function of the pm8001 driver. This vulnerability can result in resource exhaustion and potential system instability. To mitigate the risk, it is recommended to update the Kernel package to version v5.16.20 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel package is a critical component of the Linux operating system, responsible for managing the system's core functionality.
The scsi subsystem within the Kernel package handles communication with SCSI (Small Computer System Interface) devices, such as hard drives and tape drives.
The pm8001 driver is a component of the scsi subsystem that manages SAS (Serial Attached SCSI) host bus adapters based on the PM8001 chipset.
A task leak refers to a situation where resources associated with a task are not properly released, leading to resource exhaustion over time.
The impact of this vulnerability depends on the specific usage scenario and the availability of resources on the affected system. It can potentially lead to resource exhaustion and system instability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
