Use After Free Vulnerability in scsi: libfc
Summary
GSD-2022-1001713: scsi: libfc: Fix use after free in fc_exch_abts_resp(). Affects Kernel versions < f581df412bc45c95176e3c808ee2839c05b2ab0c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The scsi: libfc package is a component of the Linux Kernel that provides support for Fibre Channel (FC) storage protocols. It is responsible for handling FC exchanges and managing FC fabric services. The package is widely used in Linux-based systems for storage connectivity. However, a vulnerability has been discovered in the package that could lead to a use after free issue.
Vulnerability Detail
The use after free vulnerability in fc_exch_abts_resp() function of scsi: libfc allows an attacker to exploit a freed memory region. By sending a specially crafted request, an attacker can trigger the use of the freed memory, leading to a potential crash or arbitrary code execution. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in Linux Kernel version v5.15.34 by commit f581df412bc45c95176e3c808ee2839c05b2ab0c.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Updating the Linux Kernel to the fixed version is the recommended solution.
Conclusion
The use after free vulnerability in scsi: libfc can be mitigated by updating the Linux Kernel to version v5.15.34 or later. This vulnerability has the potential to cause crashes or arbitrary code execution. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
scsi: libfc is a component of the Linux Kernel that provides support for Fibre Channel (FC) storage protocols. It handles FC exchanges and manages FC fabric services.
A use after free vulnerability occurs when a program continues to use a memory region after it has been freed. This can lead to crashes, memory corruption, or even arbitrary code execution.
An attacker can exploit this vulnerability by sending a specially crafted request to the affected system, triggering the use of the freed memory region and potentially causing a crash or executing arbitrary code.
No, the impact and attack plausibility of this vulnerability have not been proven yet.
To fix this vulnerability, update the Linux Kernel to version v5.15.34 or later. This can be done by fetching the latest kernel source code from the official Git repository and compiling it.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
