Executive brief
A vulnerability in the Linux kernel's QLogic iSCSI (qedi) driver could allow a local user to crash the system. The issue occurs when the system attempts to read specific debug information, leading to a kernel panic. This could result in a complete service outage or denial of service for affected servers.
Technical details
The vulnerability is an out-of-bounds read/write (CWE-125) in the qedi_dbg_do_not_recover_cmd_read() function within the QLogic iSCSI (qedi) driver. The root cause is the direct use of sprintf() on a __user pointer, which bypasses proper memory safety checks and leads to a page fault/kernel oops. An attacker with local access to debugfs could trigger this crash by reading the affected attribute. The fix involves using a local stack buffer and simple_read_from_buffer() to safely handle the data transfer between kernel and user space. Patches have been released for multiple stable kernel branches.
Affected products
- Linux Linux Kernel up to 4.19.317, 4.20 to 5.4.279, 5.5 to 5.10.221, 5.11 to 5.15.162, 5.16 to 6.1.96, 6.2 to 6.6.36, 6.7 to 6.9.7
Timeline
- 2024-04-15: disclosed: Initial patch submission
- 2024-07-05: patched: Commits merged into stable branches
- 2024-07-12: advisory: CVE published
References
- https://git.kernel.org/stable/c/144d76a676b630e321556965011b00e2de0b40a7
- https://git.kernel.org/stable/c/21c963de2e86e88f6a8ca556bcebb8e62ab8e901
- https://git.kernel.org/stable/c/28027ec8e32ecbadcd67623edb290dad61e735b5
- https://git.kernel.org/stable/c/397a8990c377ee4b61d6df768e61dff9e316d46b
- https://git.kernel.org/stable/c/56bec63a7fc87ad50b3373a87517dc9770eef9e0
- https://git.kernel.org/stable/c/e2f433ea7d0ff77998766a088a287337fb43ad75
- https://git.kernel.org/stable/c/eaddb86637669f6bad89245ee63f8fb2bfb50241