CVE-2022-21546CWE-476

CVE-2022-21546

High · published May 3, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
37.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: Fix WRITE_SAME No Data Buffer crash

In newer version of the SBC specs, we have a NDOB bit that indicates there

is no data buffer that gets written out. If this bit is set using commands

like "sg_write_same --ndob" we will crash in target_core_iblock/file's

execute_write_same handlers when we go to access the se_cmd->t_data_sg

because its NULL.

This patch adds a check for the NDOB bit in the common WRITE SAME code

because we don't support it. And, it adds a check for zero SG elements in

each handler in case the initiator tries to send a normal WRITE SAME with

no data buffer.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00445 · 37.7th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2025-05-03T02:15Z
Affected products (11)
ProductVersionsFixed in
linux/linux_kernel< 5.4.2945.4.294
linux/linux_kernel≥ 5.5, < 5.10.2385.10.238
linux/linux_kernel≥ 5.11, < 5.15.1825.15.182
linux/linux_kernel≥ 5.16, < 5.195.19
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
debian/debian_linuxall versions—
References (5)
EPSS history
Timeline
  • 02 MAY 21:52Z
    scsi: target: Fix WRITE_SAME No Data Buffer crash
    cvelistv5