Use-After-Free Vulnerability in Linux Kernel SCSI Module by Vendor

CVE-2022-49730

What is CVE-2022-49730?

A use-after-free vulnerability has been identified in the Linux kernel's SCSI module. This issue arises when an ELS LOGO (Extended Link Services Log Out) operation is aborted, leading to a potential crash due to the improper handling of the nodelist structure. Upon prematurely releasing the structure, the configuration log verbosity setting for the respective vport may still be accessed, which can result in undefined behaviors or system instability. To mitigate this vulnerability, the lpfc_cmpl_els_logo() function has been adjusted to restrict the possibility of duplicate calls that lead to the release of the nodelist, ensuring safe and reliable handling of resource management.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References