Lucene search

K
vulnrichmentLinuxVULNRICHMENT:CVE-2021-47198
HistoryApr 10, 2024 - 6:56 p.m.

CVE-2021-47198 scsi: lpfc: Fix use-after-free in lpfc_unreg_rpi() routine

2024-04-1018:56:33
Linux
github.com
1
linux kernel
vulnerability
scsi
lpfc
use-after-free
nlp_reg_login_send
lpfc_unreg_rpi
lpfc_mbx_cmpl_fc_reg_login

AI Score

6.8

Confidence

Low

SSVC

Exploitation

none

Automatable

no

Technical Impact

partial

In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Fix use-after-free in lpfc_unreg_rpi() routine

An error is detected with the following report when unloading the driver:
“KASAN: use-after-free in lpfc_unreg_rpi+0x1b1b”

The NLP_REG_LOGIN_SEND nlp_flag is set in lpfc_reg_fab_ctrl_node(), but the
flag is not cleared upon completion of the login.

This allows a second call to lpfc_unreg_rpi() to proceed with nlp_rpi set
to LPFC_RPI_ALLOW_ERROR. This results in a use after free access when used
as an rpi_ids array index.

Fix by clearing the NLP_REG_LOGIN_SEND nlp_flag in
lpfc_mbx_cmpl_fc_reg_login().

AI Score

6.8

Confidence

Low

SSVC

Exploitation

none

Automatable

no

Technical Impact

partial