Use After Free Vulnerability in scsi: libfc
Summary
GSD-2022-1002476: scsi: libfc: Fix use after free in fc_exch_abts_resp(). Affects Kernel versions < 4a131d4ea8b581ac9b01d3a72754db4848be3232. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The scsi: libfc package is a component of the Linux Kernel, which is responsible for handling the Fibre Channel (FC) protocol. It provides the necessary functions and structures for FC communication between devices. The vulnerability identified in this package is a use after free issue in the fc_exch_abts_resp() function.
Vulnerability Detail
The use after free vulnerability in fc_exch_abts_resp() can be exploited by an attacker to execute arbitrary code or cause a denial of service. This vulnerability occurs when a pointer to a previously freed memory object is dereferenced, leading to unpredictable behavior. An attacker could potentially manipulate the freed memory to execute malicious code or crash the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the provided fix by updating the Linux Kernel.
Conclusion
In conclusion, the use after free vulnerability in scsi: libfc can lead to arbitrary code execution or denial of service. It is crucial to update the Linux Kernel to version v4.9.311 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can allow an attacker to execute arbitrary code or cause a denial of service.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will provide real-time alerts for open-source vulnerabilities.
At the time of this report, there is no known public exploit for this vulnerability. However, it is important to apply the fix as soon as possible to mitigate any potential risks.
Yes, this vulnerability can be exploited remotely if the affected system is exposed to the attacker's malicious code or commands.
An attacker would need to have the ability to send crafted FC messages to the affected system in order to exploit this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
