CVE-2024-24855 Race condition vulnerability in Linux kernel scsi device driver lpfc_unregister_fcf_rescan()

2024-02-0507:25:41

CWE-362

Anolis

github.com

cve-2024-24855

linux kernel

lpfc driver

null pointer dereference

kernel panic

denial of service

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H

AI Score

7.1

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

A race condition was found in the Linux kernel’s scsi device driver in lpfc_unregister_fcf_rescan() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.

CNA Affected

[
  {
    "repo": "https://gitee.com/anolis/cloud-kernel.git",
    "vendor": "Linux",
    "modules": [
      "scsi"
    ],
    "product": "Linux kernel",
    "versions": [
      {
        "status": "affected",
        "version": "v2.6.34-rc2",
        "lessThan": "v6.5-rc2",
        "versionType": "custom"
      }
    ],
    "platforms": [
      "Linux",
      "x86",
      "ARM"
    ],
    "packageName": "kernel",
    "programFiles": [
      "https://gitee.com/anolis/cloud-kernel/blob/devel-5.10/drivers/scsi/lpfc/lpfc_hbadisc.c"
    ],
    "collectionURL": "https://kernel.org/",
    "defaultStatus": "unaffected"
  }
]