Denial of Service Vulnerability in Oracle Linux I/O Subsystem

CVE-2022-21546

What is CVE-2022-21546?

A Denial of Service vulnerability exists in the Oracle Linux I/O subsystem. This issue arises when a specific bit in the newer SBC specifications, known as the NDOB bit, is set to indicate that no data buffer should be written. Executing commands like 'sg_write_same --ndob' can lead to a system crash, as the system attempts to access a NULL pointer in the execute_write_same handlers of target_core_iblock/file. This flaw disrupts availability, exposing users to potential downtime and service outages.

References