Lucene search

K
vulnrichmentLinuxVULNRICHMENT:CVE-2024-43816
HistoryAug 17, 2024 - 9:21 a.m.

CVE-2024-43816 scsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages

2024-08-1709:21:38
Linux
github.com
2
linux kernel
scsi lpfc
endian macro
memory out of bounds
pointer dereference
fcp targets
big endian
little endian
crash
sgl.

AI Score

6.8

Confidence

Low

SSVC

Exploitation

none

Automatable

no

Technical Impact

partial

In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages

On big endian architectures, it is possible to run into a memory out of
bounds pointer dereference when FCP targets are zoned.

In lpfc_prep_embed_io, the memcpy(ptr, fcp_cmnd, sgl->sge_len) is
referencing a little endian formatted sgl->sge_len value. So, the memcpy
can cause big endian systems to crash.

Redefine the *sgl ptr as a struct sli4_sge_le to make it clear that we are
referring to a little endian formatted data structure. And, update the
routine with proper le32_to_cpu macro usages.

AI Score

6.8

Confidence

Low

SSVC

Exploitation

none

Automatable

no

Technical Impact

partial

Related for VULNRICHMENT:CVE-2024-43816