Resource management error in Linux kernel scsi qedf driver

1) Resource management error

EUVDB-ID: #VU94485

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48825

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the qedf_vport_create() function in drivers/scsi/qedf/qedf_main.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

External links

http://git.kernel.org/stable/c/aa7352aa155e19815b41f09f114fe9f110fde4d8
http://git.kernel.org/stable/c/1f53bbf27a876f7e61262bd74c18680ac11d4c31
http://git.kernel.org/stable/c/0be556512cd0dfcf5ec1a140d9f42d88221a5d4e
http://git.kernel.org/stable/c/b70a99fd13282d7885f69bf1372e28b7506a1613

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.