#VU104758 Improper error handling in Linux kernel - CVE-2022-49158

Vulnerability identifier: #VU104758

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49158

CWE-ID: CWE-388

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the qla2x00_async_login_sp_done(), qla2x00_async_adisc_sp_done() and qla2x00_async_prli_sp_done() functions in drivers/scsi/qla2xxx/qla_init.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/64f24af75b79cba3b86b0760e27e0fa904db570f
https://git.kernel.org/stable/c/7a3457777c4f700c64836e78dc71e6ce459f62b8
https://git.kernel.org/stable/c/b13baf97ddbc1a7e7536168383bc0d84c2204b03
https://git.kernel.org/stable/c/d8fb8da69e194e0249b3cdb746ef09ce823ae26b

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.