Log in Start free

Vulnerability · Published Apr 10, 2024 · Assigned by Linux

CVE-2021-47203scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()

High 8.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.3%top 71.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() When parsing the txq list in lpfc_drain_txq(), the driver attempts to pass the requests to the adapter. If such an attempt fails, a local "fail_msg" string is set and a log message output. The job is then added to a completions list for cancellation. Processing of any further jobs from the txq list continues, but since "fail_msg" remains set, jobs are added to the completions list regardless of whether a wqe was passed to the adapter. If successfully added to txcmplq, jobs are added to both lists resulting in list corruption. Fix by clearing the fail_msg string after adding a job to the completions list. This stops the subsequent jobs from being added to the completions list unless they had an appropriate failure.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux5.15.5-1DEBIAN-CVE-2021-47203
Debian:13linux5.15.5-1DEBIAN-CVE-2021-47203
Debian:14linux5.15.5-1DEBIAN-CVE-2021-47203
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2021-47203
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2021-47203
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2021-47203
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2021-47203
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2021-47203
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2021-47203
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2021-47203
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2021-47203
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2021-47203
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2021-47203
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2021-47203
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2021-47203
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2021-47203
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2021-47203
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2021-47203
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2021-47203
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2021-47203
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2021-47203
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2021-47203
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2021-47203
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2021-47203
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2021-47203
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2021-47203
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2021-47203

Affected products (as reported)

VendorProductVersions
Linux Linux 2a9bf3d011303d8da64cd5e0e7fdd95f0c143984 – before ad4776b5eb2e58af1226847fcd3b4f6d051674dd2a9bf3d011303d8da64cd5e0e7fdd95f0c143984 – before ec70d80a8642900086447ba0cdc79e3f44d42e8f2a9bf3d011303d8da64cd5e0e7fdd95f0c143984 – before f05a0191b90156e539cccc189b9d87ca2a4d93052a9bf3d011303d8da64cd5e0e7fdd95f0c143984 – before b291d147d0268e93ad866f8bc820ea14497abc9b2a9bf3d011303d8da64cd5e0e7fdd95f0c143984 – before 16bcbfb56d759c25665f786e33ec633b9508a08f2a9bf3d011303d8da64cd5e0e7fdd95f0c143984 – before c097bd5a59162156d9c2077a2f58732ffbaa9fca2a9bf3d011303d8da64cd5e0e7fdd95f0c143984 – before 814d3610c4ce86e8cf285b2cdac0057a42e82de52a9bf3d011303d8da64cd5e0e7fdd95f0c143984 – before 99154581b05c8fb22607afb7c3d66c1bace6aa5d
Linux Linux 2.6.36

References