CVE-2021-46963 scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand()

2024-02-2718:47:01

Linux

github.com

linux kernel

vulnerability resolved

scsi fix

AI Score

6.7

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand()

RIP: 0010:kmem_cache_free+0xfa/0x1b0
Call Trace:
   qla2xxx_mqueuecommand+0x2b5/0x2c0 [qla2xxx]
   scsi_queue_rq+0x5e2/0xa40
   __blk_mq_try_issue_directly+0x128/0x1d0
   blk_mq_request_issue_directly+0x4e/0xb0

Fix incorrect call to free srb in qla2xxx_mqueuecommand(), as srb is now
allocated by upper layers. This fixes smatch warning of srb unintended
free.

CNA Affected

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "64a8c5018a4b",
        "lessThan": "c5ab9b67d8b0",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "dea6ee717303",
        "lessThan": "77509a238547",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "af2a0c51b120",
        "lessThan": "702cdaa2c628",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "af2a0c51b120",
        "lessThan": "80ef24175df2",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "af2a0c51b120",
        "lessThan": "a73208e32441",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "af2a0c51b120",
        "lessThan": "6641df81ab79",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/scsi/qla2xxx/qla_os.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.5"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.5",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "4.19.191",
        "versionType": "custom",
        "lessThanOrEqual": "4.19.*"
      },
      {
        "status": "unaffected",
        "version": "5.4.118",
        "versionType": "custom",
        "lessThanOrEqual": "5.4.*"
      },
      {
        "status": "unaffected",
        "version": "5.10.36",
        "versionType": "custom",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.11.20",
        "versionType": "custom",
        "lessThanOrEqual": "5.11.*"
      },
      {
        "status": "unaffected",
        "version": "5.12.3",
        "versionType": "custom",
        "lessThanOrEqual": "5.12.*"
      },
      {
        "status": "unaffected",
        "version": "5.13",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/scsi/qla2xxx/qla_os.c"
    ],
    "defaultStatus": "affected"
  }
]