CVE-2022-49159

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Implement ref count for SRB

The timeout handler and the done function are racing. When

qla2x00_async_iocb_timeout() starts to run it can be preempted by the

normal response path (via the firmware?). qla24xx_async_gpsc_sp_done()

releases the SRB unconditionally. When scheduling back to

qla2x00_async_iocb_timeout() qla24xx_async_abort_cmd() will access an freed

sp->qpair pointer:

qla2xxx [0000:83:00.0]-2871:0: Async-gpsc timeout - hdl=63d portid=234500 50:06:0e:80:08:77:b6:21.

qla2xxx [0000:83:00.0]-2853:0: Async done-gpsc res 0, WWPN 50:06:0e:80:08:77:b6:21

qla2xxx [0000:83:00.0]-2854:0: Async-gpsc OUT WWPN 20:45:00:27:f8:75:33:00 speeds=2c00 speed=0400.

qla2xxx [0000:83:00.0]-28d8:0: qla24xx_handle_gpsc_event 50:06:0e:80:08:77:b6:21 DS 7 LS 6 rc 0 login 1|1 rscn 1|0 lid 5

BUG: unable to handle kernel NULL pointer dereference at 0000000000000004

IP: qla24xx_async_abort_cmd+0x1b/0x1c0 [qla2x

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References