PT-2021-8175 · Linux+5 · Linux Kernel+5
James Smart
·
Published
2021-09-14
·
Updated
2024-10-25
·
CVE-2021-47203
CVSS v2.0
6.8
Medium
| Vector | AV:L/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue is related to a list corruption vulnerability in the Linux kernel's lpfc driver. When the driver attempts to pass requests to the adapter and fails, a local
fail msg string is set, and a log message is output. The job is then added to a completions list for cancellation. However, since fail msg remains set, subsequent jobs are added to the completions list regardless of whether a wqe was passed to the adapter, resulting in list corruption. The fix involves clearing the fail msg string after adding a job to the completions list. This prevents subsequent jobs from being added to the completions list unless they had an appropriate failure. The vulnerability may allow an attacker to execute arbitrary code.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Buffer Overflow
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Centos
Linux Kernel
Red Hat
Red Os
Suse