cve-2024-43816
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:16
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages On big endian architectures, it is possible to run into a memory out of bounds pointer dereference when FCP targets are zoned. In lpfc_prep_embed_io, the memcpy(ptr, fcp_cmnd, sgl->sge_len) is referencing a little endian formatted sgl->sge_len value. So, the memcpy can cause big endian systems to crash. Redefine the *sgl ptr as a struct sli4_sge_le to make it clear that we are referring to a little endian formatted data structure. And, update the routine with proper le32_to_cpu macro usages.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8bc7c617642db6d8d20ee671fb6c4513017e7a7e
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9fd003f344d502f65252963169df3dd237054e49
Impacted products
Vendor Product Version
Linux Linux Version: af20bb73ac2591631d504f3f859f073bcdb7e11e
Version: af20bb73ac2591631d504f3f859f073bcdb7e11e
 Create a notification for this product.
   Linux Linux Version: 6.10
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43816",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:09:16.258182Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:04.878Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/lpfc/lpfc_sli.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9fd003f344d502f65252963169df3dd237054e49",
              "status": "affected",
              "version": "af20bb73ac2591631d504f3f859f073bcdb7e11e",
              "versionType": "git"
            },
            {
              "lessThan": "8bc7c617642db6d8d20ee671fb6c4513017e7a7e",
              "status": "affected",
              "version": "af20bb73ac2591631d504f3f859f073bcdb7e11e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/lpfc/lpfc_sli.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages\n\nOn big endian architectures, it is possible to run into a memory out of\nbounds pointer dereference when FCP targets are zoned.\n\nIn lpfc_prep_embed_io, the memcpy(ptr, fcp_cmnd, sgl-\u003esge_len) is\nreferencing a little endian formatted sgl-\u003esge_len value.  So, the memcpy\ncan cause big endian systems to crash.\n\nRedefine the *sgl ptr as a struct sli4_sge_le to make it clear that we are\nreferring to a little endian formatted data structure.  And, update the\nroutine with proper le32_to_cpu macro usages."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T09:16:25.162Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9fd003f344d502f65252963169df3dd237054e49"
        },
        {
          "url": "https://git.kernel.org/stable/c/8bc7c617642db6d8d20ee671fb6c4513017e7a7e"
        }
      ],
      "title": "scsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-43816",
    "datePublished": "2024-08-17T09:21:38.926Z",
    "dateReserved": "2024-08-17T09:11:59.270Z",
    "dateUpdated": "2024-12-19T09:16:25.162Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-43816\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-17T10:15:07.950\",\"lastModified\":\"2024-08-19T12:59:59.177\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages\\n\\nOn big endian architectures, it is possible to run into a memory out of\\nbounds pointer dereference when FCP targets are zoned.\\n\\nIn lpfc_prep_embed_io, the memcpy(ptr, fcp_cmnd, sgl-\u003esge_len) is\\nreferencing a little endian formatted sgl-\u003esge_len value.  So, the memcpy\\ncan cause big endian systems to crash.\\n\\nRedefine the *sgl ptr as a struct sli4_sge_le to make it clear that we are\\nreferring to a little endian formatted data structure.  And, update the\\nroutine with proper le32_to_cpu macro usages.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: lpfc: Revisar la rutina lpfc_prep_embed_io con usos de macro endian adecuados. En arquitecturas big endian, es posible ejecutar una desreferencia de puntero de memoria fuera de los l\u00edmites cuando los objetivos FCP est\u00e1n divididos en zonas. En lpfc_prep_embed_io, memcpy(ptr, fcp_cmnd, sgl-\u0026gt;sge_len) hace referencia a un valor sgl-\u0026gt;sge_len con formato little endian. Por lo tanto, memcpy puede provocar que los sistemas big endian colapsen. Redefina *sgl ptr como una estructura sli4_sge_le para dejar claro que nos referimos a una estructura de datos con formato little endian. Y actualice la rutina con usos adecuados de la macro le32_to_cpu.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/8bc7c617642db6d8d20ee671fb6c4513017e7a7e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9fd003f344d502f65252963169df3dd237054e49\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-43816\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:09:16.258182Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:14.260Z\"}}], \"cna\": {\"title\": \"scsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"af20bb73ac2591631d504f3f859f073bcdb7e11e\", \"lessThan\": \"9fd003f344d502f65252963169df3dd237054e49\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"af20bb73ac2591631d504f3f859f073bcdb7e11e\", \"lessThan\": \"8bc7c617642db6d8d20ee671fb6c4513017e7a7e\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/scsi/lpfc/lpfc_sli.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.10.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/scsi/lpfc/lpfc_sli.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9fd003f344d502f65252963169df3dd237054e49\"}, {\"url\": \"https://git.kernel.org/stable/c/8bc7c617642db6d8d20ee671fb6c4513017e7a7e\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages\\n\\nOn big endian architectures, it is possible to run into a memory out of\\nbounds pointer dereference when FCP targets are zoned.\\n\\nIn lpfc_prep_embed_io, the memcpy(ptr, fcp_cmnd, sgl-\u003esge_len) is\\nreferencing a little endian formatted sgl-\u003esge_len value.  So, the memcpy\\ncan cause big endian systems to crash.\\n\\nRedefine the *sgl ptr as a struct sli4_sge_le to make it clear that we are\\nreferring to a little endian formatted data structure.  And, update the\\nroutine with proper le32_to_cpu macro usages.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T09:16:25.162Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-43816\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T09:16:25.162Z\", \"dateReserved\": \"2024-08-17T09:11:59.270Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-17T09:21:38.926Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.