Vulnerability in Kernel: Put LLD module refcnt after SCSI device is released
Summary
UVI-2021-1001967: scsi: core: Put LLD module refcnt after SCSI device is released. Affects Kernel versions < 61a0faa89f21861d1f8d059123b5c285a5d9ffee. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionalities and interfaces with hardware devices. It manages the communication between the hardware and software layers, including handling input/output operations. The SCSI (Small Computer System Interface) subsystem is responsible for managing storage devices, such as hard drives and tape drives, connected to the system. The vulnerability in the Kernel's SCSI core module allows for a reference count issue related to the LLD (Low-Level Driver) module when a SCSI device is released.
Vulnerability Detail
The vulnerability arises from a failure to properly handle the reference count of the LLD module after a SCSI device is released. This can lead to a use-after-free scenario, where the LLD module may still be accessed even though it has been freed. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Users are advised to update their Kernel to the fixed version as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in the Kernel's SCSI core module, which allows for a reference count issue related to the LLD module, has been fixed in Linux Kernel version v4.14.255. Users are advised to update their Kernel to the latest version to ensure the security of their systems. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel is a critical component of the Linux operating system that provides core functionalities and interfaces with hardware devices.
The SCSI (Small Computer System Interface) subsystem is responsible for managing storage devices, such as hard drives and tape drives, connected to the system.
LLD (Low-Level Driver) module is a component of the SCSI subsystem that handles the communication between the Kernel and the specific hardware device.
A use-after-free vulnerability occurs when a program continues to use a memory reference after it has been freed, leading to potential security issues.
If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code or cause a denial-of-service condition.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
