Improper error handling in Linux kernel scsi driver

1) Improper error handling

EUVDB-ID: #VU90937

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47258

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the scsi_host_alloc() function in drivers/scsi/hosts.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:*:*:*:*:*:*:*:*

External links

https://git.kernel.org/stable/c/8958181c1663e24a13434448e7d6b96b5d04900a
https://git.kernel.org/stable/c/db08ce595dd64ea9859f7d088b51cbfc8e685c66
https://git.kernel.org/stable/c/2dc85045ae65b9302a1d2e2ddd7ce4c030153a6a
https://git.kernel.org/stable/c/79296e292d67fa7b5fb8d8c27343683e823872c8
https://git.kernel.org/stable/c/7a696ce1d5d16a33a6cd6400bbcc0339b2460e11
https://git.kernel.org/stable/c/45d83db4728127944b237c0c8248987df9d478e7
https://git.kernel.org/stable/c/66a834d092930cf41d809c0e989b13cd6f9ca006

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.