CVE-2022-49789

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: zfcp: Fix double free of FSF request when qdio send fails

We used to use the wrong type of integer in 'zfcp_fsf_req_send()' to cache

the FSF request ID when sending a new FSF request. This is used in case the

sending fails and we need to remove the request from our internal hash

table again (so we don't keep an invalid reference and use it when we free

the request again).

In 'zfcp_fsf_req_send()' we used to cache the ID as 'int' (signed and 32

bit wide), but the rest of the zfcp code (and the firmware specification)

handles the ID as 'unsigned long'/'u64' (unsigned and 64 bit wide [s390x

ELF ABI]). For one this has the obvious problem that when the ID grows

past 32 bit (this can happen reasonably fast) it is truncated to 32 bit

when storing it in the cache variable and so doesn't match the original ID

anymore. The second less obvious problem is that even when the original ID

has not yet grown past 32 bit, as

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References