Resource Leak in megaraid_sas Probe Failure
Summary
UVI-2021-1001334: scsi: megaraid_sas: Fix resource leak in case of probe failure. Affects Kernel versions < 0c6226601c3e191a44a57d8f9f814b7e5c308959. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The megaraid_sas package is a SCSI driver for the MegaRAID SAS family of RAID controllers. It provides functionality for managing and accessing storage devices connected to these controllers. The package is a part of the Linux Kernel ecosystem and is widely used in various Linux distributions. However, a vulnerability has been discovered in the megaraid_sas driver that can lead to a resource leak in case of probe failure.
Vulnerability Detail
The vulnerability in the megaraid_sas driver occurs when the probe process fails. In such cases, certain resources are not properly released, leading to a resource leak. This can result in memory or other resource exhaustion, potentially causing system instability or denial of service. The vulnerability has been identified and fixed in the Linux Kernel version v5.4.134 by commit 0c6226601c3e191a44a57d8f9f814b7e5c308959.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The megaraid_sas package in the Linux Kernel is vulnerable to a resource leak in case of probe failure. This vulnerability has been fixed in the Linux Kernel version v5.4.134. It is recommended to update the Kernel to the fixed version or manually apply the provided commit to ensure the security and stability of the system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
megaraid_sas is a SCSI driver for the MegaRAID SAS family of RAID controllers, providing functionality for managing and accessing storage devices connected to these controllers.
The vulnerability can lead to a resource leak in case of probe failure, potentially causing memory or other resource exhaustion and system instability or denial of service.
To fix this vulnerability, update the Linux Kernel to version v5.4.134 or later. Alternatively, manually apply the commit 0c6226601c3e191a44a57d8f9f814b7e5c308959 to the Kernel source code and rebuild the Kernel.
No specific workaround has been mentioned for this vulnerability.
For more details about this vulnerability, refer to the source link provided in the database_specific section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
