Vulnerability in Kernel: scsi: pm8001: Fix task leak in pm8001_send_abort_all()
Summary
GSD-2022-1001724: scsi: pm8001: Fix task leak in pm8001_send_abort_all(). Affects Kernel versions < 2290dcad6f65864dec518fb2d5fb45f67d684150. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages communication between hardware and software. It provides essential functions and services for the proper functioning of the system. The scsi subsystem in the Kernel handles communication with SCSI devices, including storage devices. One of the drivers in the scsi subsystem is pm8001, which is responsible for managing SAS/SATA controllers based on the PM8001 chip. This vulnerability specifically affects the pm8001_send_abort_all() function in the pm8001 driver.
Vulnerability Detail
The pm8001_send_abort_all() function in the pm8001 driver in the Kernel suffers from a task leak vulnerability. This vulnerability can be exploited by an attacker to cause a resource exhaustion condition by repeatedly sending abort commands to the SCSI devices managed by the pm8001 driver. This can lead to a denial of service (DoS) situation, impacting the availability of the affected system. The vulnerability has been fixed in Linux Kernel version v5.15.34 by commit 2290dcad6f65864dec518fb2d5fb45f67d684150.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the official fix by updating the Linux Kernel.
Conclusion
In conclusion, the scsi: pm8001: Fix task leak in pm8001_send_abort_all() vulnerability in the Kernel can lead to a denial of service (DoS) situation by causing a resource exhaustion condition. It is crucial to update the Linux Kernel to version v5.15.34 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can lead to a denial of service (DoS) situation by causing a resource exhaustion condition in the affected system.
No, this vulnerability requires an attacker to have local access to the system in order to exploit it.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
Yes, a patch for this vulnerability has been released in Linux Kernel version v5.15.34.
You can find more information about this vulnerability in the official Linux Kernel Git repository and the associated commit (2290dcad6f65864dec518fb2d5fb45f67d684150).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
