CVE-2024-46843: scsi: ufs: core: Remove SCSI host only if added
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: core: Remove SCSI host only if added
If host tries to remove ufshcd driver from a UFS device it would cause a kernel panic if ufshcdasyncscan fails during ufshcdprobehba before adding a SCSI host with scsiaddhost and MCQ is enabled since SCSI host has been defered after MCQ configuration introduced by commit 0cab4023ec7b ("scsi: ufs: core: Defer adding host to SCSI if MCQ is supported").
To guarantee that SCSI host is removed only if it has been added, set the scsihostadded flag to true after adding a SCSI host and check whether it is set or not before removing it.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-46843?
CVE-2024-46843 is considered a high severity vulnerability due to its potential to cause kernel panic.
How do I fix CVE-2024-46843?
To fix CVE-2024-46843, upgrade to Linux Kernel version 6.12.11-1 or higher.
Which Linux Kernel versions are affected by CVE-2024-46843?
CVE-2024-46843 affects Linux Kernel versions from 6.7 to 6.6.51 inclusive.
What can happen if CVE-2024-46843 is exploited?
Exploiting CVE-2024-46843 can lead to a system crash or kernel panic when attempting to remove the ufshcd driver.
Is CVE-2024-46843 specific to any particular Linux distribution?
CVE-2024-46843 is specific to the Linux Kernel and may affect various distributions using vulnerable kernel versions.