Log in Start free

Vulnerability · Published Feb 27, 2024 · Assigned by Linux

CVE-2021-46963scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand()

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 83.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand() RIP: 0010:kmem_cache_free+0xfa/0x1b0 Call Trace: qla2xxx_mqueuecommand+0x2b5/0x2c0 [qla2xxx] scsi_queue_rq+0x5e2/0xa40 __blk_mq_try_issue_directly+0x128/0x1d0 blk_mq_request_issue_directly+0x4e/0xb0 Fix incorrect call to free srb in qla2xxx_mqueuecommand(), as srb is now allocated by upper layers. This fixes smatch warning of srb unintended free.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux5.10.38-1DEBIAN-CVE-2021-46963
Debian:13linux5.10.38-1DEBIAN-CVE-2021-46963
Debian:14linux5.10.38-1DEBIAN-CVE-2021-46963
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2021-46963
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2021-46963
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2021-46963
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2021-46963
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2021-46963
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2021-46963
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2021-46963
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2021-46963
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2021-46963
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2021-46963
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2021-46963
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2021-46963
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2021-46963
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2021-46963
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2021-46963
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2021-46963
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2021-46963
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2021-46963
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2021-46963
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2021-46963
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2021-46963
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2021-46963
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2021-46963
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2021-46963

Affected products (as reported)

VendorProductVersions
Linux Linux 64a8c5018a4b21b04a756a56c495ef47c14e92d9 – before c5ab9b67d8b061de74e2ca51bf787ee599bd7f89dea6ee7173039d489977c9ed92e3749154615db4 – before 77509a238547863040a42d57c72403f7d4c89a8faf2a0c51b1205327f55a7e82e530403ae1d42cbb – before 702cdaa2c6283c135ef16d52e0e4e3c1005aa538af2a0c51b1205327f55a7e82e530403ae1d42cbb – before 80ef24175df2cba3860d0369d1c662b49ee2de56af2a0c51b1205327f55a7e82e530403ae1d42cbb – before a73208e3244127ef9f2cdf24e4adb947aaa32053af2a0c51b1205327f55a7e82e530403ae1d42cbb – before 6641df81ab799f28a5d564f860233dd26cca0d934a1cc2f71bc57cf8dee6f58e7d2355a43aabb3124.19.90 – before 4.19.191
Linux Linux 5.5

References