Race condition in Linux kernel scsi lpfc driver

1) Race condition

EUVDB-ID: #VU91463

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36952

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the lpfc_vport_delete() function in drivers/scsi/lpfc/lpfc_vport.c. A local user can escalate privileges on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

External links

http://git.kernel.org/stable/c/f2c7f029051edc4b394bb48edbe2297575abefe0
http://git.kernel.org/stable/c/0936809d968ecf81e0726fbd02ff2a5732d960c3
http://git.kernel.org/stable/c/76337eb8daee32bcc67742efab3168ed4ca299d0
http://git.kernel.org/stable/c/718602cd15f4c5710850090ea3066a89eeb46278
http://git.kernel.org/stable/c/4ddf01f2f1504fa08b766e8cfeec558e9f8eef6c

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.