CVE-2024-43816CWE-476

CVE-2024-43816

High · published August 17, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
9.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages

On big endian architectures, it is possible to run into a memory out of

bounds pointer dereference when FCP targets are zoned.

In lpfc_prep_embed_io, the memcpy(ptr, fcp_cmnd, sgl->sge_len) is

referencing a little endian formatted sgl->sge_len value. So, the memcpy

can cause big endian systems to crash.

Redefine the *sgl ptr as a struct sli4_sge_le to make it clear that we are

referring to a little endian formatted data structure. And, update the

routine with proper le32_to_cpu macro usages.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00203 · 9.8th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2024-08-17T14:15Z
Affected products (1)
ProductVersionsFixed in
linux/linux_kernel≥ 6.10, < 6.10.36.10.3
References (2)
EPSS history
Timeline
  • 17 AUG 09:21Z
    scsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages
    cvelistv5