CVE-2021-47203: scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()
In the Linux kernel, the following vulnerability has been resolved:
scsi: lpfc: Fix listadd() corruption in lpfcdraintxq()
When parsing the txq list in lpfcdraintxq(), the driver attempts to pass the requests to the adapter. If such an attempt fails, a local "failmsg" string is set and a log message output. The job is then added to a completions list for cancellation.
Processing of any further jobs from the txq list continues, but since "failmsg" remains set, jobs are added to the completions list regardless of whether a wqe was passed to the adapter. If successfully added to txcmplq, jobs are added to both lists resulting in list corruption.
Fix by clearing the failmsg string after adding a job to the completions list. This stops the subsequent jobs from being added to the completions list unless they had an appropriate failure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix the list corruption by clearing the fail_msg string after a job is successfully added to the completions list during lpfc_drain_txq() processing.
Linux kernel (lpfc_drain_txq) fail_msg (string used for failure logging) = cleared/emptied after adding a job to the completions list - Compensating control
During lpfc_drain_txq() parsing of the txq list, prevent subsequent txq jobs from being added to the completions list when the job is already handled/added for cancellation—stop further completions additions after completing the relevant cancellation handling.
Event History
Frequently Asked Questions
What is the severity of CVE-2021-47203?
CVE-2021-47203 is classified as a medium severity vulnerability within the Linux kernel.
Which systems are affected by CVE-2021-47203?
CVE-2021-47203 affects the Linux kernel, specifically those versions that utilize the lpfc driver.
How do I fix CVE-2021-47203?
To fix CVE-2021-47203, update your Linux kernel to the latest stable version where the vulnerability has been patched.
What issue does CVE-2021-47203 address in the Linux kernel?
CVE-2021-47203 addresses a corruption issue in the list_add() function within lpfc_drain_txq() in the SCSI lpfc driver.
What impact does CVE-2021-47203 have on system performance?
CVE-2021-47203 can potentially lead to data corruption, affecting system stability and performance when using the lpfc driver.