CVE-2021-47337

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: core: Fix bad pointer dereference when ehandler kthread is invalid

Commit 66a834d09293 ("scsi: core: Fix error handling of scsi_host_alloc()")

changed the allocation logic to call put_device() to perform host cleanup

with the assumption that IDA removal and stopping the kthread would

properly be performed in scsi_host_dev_release(). However, in the unlikely

case that the error handler thread fails to spawn, shost->ehandler is set

to ERR_PTR(-ENOMEM).

The error handler cleanup code in scsi_host_dev_release() will call

kthread_stop() if shost->ehandler != NULL which will always be the case

whether the kthread was successfully spawned or not. In the case that it

failed to spawn this has the nasty side effect of trying to dereference an

invalid pointer when kthread_stop() is called. The following splat provides

an example of this behavior in the wild:

scsi host11: error handler thread failed to spawn, error = -4

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References