In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path<\/p>\n
qla2x00_status_entry() filters out non-TYPE_SRB entries and the
\nSRB_NVME_CMD, SRB_BIDI_CMD and SRB_TM_CMD types, then falls through to a
\nSCSI fast path that assumes the command is an SRB_SCSI_CMD. The first
\nthing on that path, qla_chk_edif_rx_sa_delete_pending(), and the
\nsubsequent handling both evaluate GET_CMD_SP(sp), i.e. sp->u.scmd.cmd.<\/p>\n
The srb u union overlays the SCSI command pointer with other command
\nlayouts (bsg_job, iocb_cmd). If firmware delivers an unexpected
\nSTATUS_TYPE IOCB for a non-SCSI handle, sp->u.scmd.cmd can read as a
\nnon-NULL garbage pointer, bypassing the NULL checks in
\nqla_chk_edif_rx_sa_delete_pending() and at the cp == NULL test, and
\nleading to a wild pointer dereference.<\/p>\n
Reject any SRB whose type is not SRB_SCSI_CMD before entering the fast
\npath. The outstanding_cmds slot is left untouched so a genuinely
\nnon-SCSI command still completes through its proper handler.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path<\/p>\n
qla2x00_status_entry() filters out non-TYPE_SRB entries and the
\nSRB_NV<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24536","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24536","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24536"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24536"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24536"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}