In the Linux kernel, the following vulnerability has been resolved:
scsi: lpfc: Resolve NULL ptr dereference after an ELS LOGO is aborted
A use-after-free crash can occur after an ELS LOGO is aborted.
Specifically, a nodelist structure is freed and then ndlp->vport->cfglogverbose is dereferenced in lpfcnlpget() when the discovery state machine is mistakenly called a second time with NLPEVTDEVICE_RM argument.
Rework lpfccmplels_logo() to prevent the duplicate calls to release a nodelist structure.
[
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49730-23cbeebf",
"digest": {
"line_hashes": [
"261090575386277878807812483873611475738",
"233251153309802705923465037398096675021",
"81645605219366739017527393097158178109",
"113784717649141474982725648551744476788",
"61746974526404243546071485430857279259",
"334174367268215360875263957782309975667",
"24176860832770406059524594201747711806",
"97014055769086657776820825880375847360",
"209091900606049461375330208969833764707",
"239468178350444378886815689381937680680",
"240990622185841265892364864825097789701",
"137214841023198471230601240033074413191",
"122355787091232024149045229859937458563",
"232380703512278964216514861856220861605",
"146292083286979978287209402092170078617",
"57990775736622892913807340853122359019",
"259840338650111321794434730161104728846",
"197230037737383884840711673297611741232"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e83869e29448958f8ae2c6911f350318f75e4fc",
"signature_type": "Line",
"target": {
"file": "drivers/scsi/lpfc/lpfc_els.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49730-34ef1261",
"digest": {
"function_hash": "229825258632661695683220242435728519014",
"length": 2450.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eea34ce23dc3a595695856dc73bb132a9c5a2902",
"signature_type": "Function",
"target": {
"function": "lpfc_cmpl_els_logo",
"file": "drivers/scsi/lpfc/lpfc_els.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49730-5b21bb3f",
"digest": {
"function_hash": "31985031615911374827021119274642539347",
"length": 2473.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b1b3440f437b75fb2a9b0cfe58df461e40eca474",
"signature_type": "Function",
"target": {
"function": "lpfc_cmpl_els_logo",
"file": "drivers/scsi/lpfc/lpfc_els.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49730-5bc3a7fa",
"digest": {
"line_hashes": [
"231265855216076113144088752586745024479",
"30949778293455480201270438145365733495",
"68514581814722883891262953143231312277",
"291700319643095666004176807040048915698",
"205018024964935473990897882604893322743",
"178873939191715418601036655327513169898",
"261090575386277878807812483873611475738",
"233251153309802705923465037398096675021",
"81645605219366739017527393097158178109",
"113784717649141474982725648551744476788",
"61746974526404243546071485430857279259",
"334174367268215360875263957782309975667",
"24176860832770406059524594201747711806",
"97014055769086657776820825880375847360",
"209091900606049461375330208969833764707",
"239468178350444378886815689381937680680",
"52453943400154075095299020614871672591",
"152478949861551383383896336527679650561",
"106322008575550556015334758652253761158",
"232380703512278964216514861856220861605",
"146292083286979978287209402092170078617",
"57990775736622892913807340853122359019",
"259840338650111321794434730161104728846",
"197230037737383884840711673297611741232"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b1b3440f437b75fb2a9b0cfe58df461e40eca474",
"signature_type": "Line",
"target": {
"file": "drivers/scsi/lpfc/lpfc_els.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49730-6a147f97",
"digest": {
"function_hash": "219122278733224621901939049656185541693",
"length": 2408.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e83869e29448958f8ae2c6911f350318f75e4fc",
"signature_type": "Function",
"target": {
"function": "lpfc_cmpl_els_logo",
"file": "drivers/scsi/lpfc/lpfc_els.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49730-a1cd22c8",
"digest": {
"line_hashes": [
"261090575386277878807812483873611475738",
"233251153309802705923465037398096675021",
"81645605219366739017527393097158178109",
"113784717649141474982725648551744476788",
"61746974526404243546071485430857279259",
"334174367268215360875263957782309975667",
"24176860832770406059524594201747711806",
"97014055769086657776820825880375847360",
"209091900606049461375330208969833764707",
"239468178350444378886815689381937680680",
"52453943400154075095299020614871672591",
"152478949861551383383896336527679650561",
"106322008575550556015334758652253761158",
"232380703512278964216514861856220861605",
"146292083286979978287209402092170078617",
"57990775736622892913807340853122359019",
"259840338650111321794434730161104728846",
"197230037737383884840711673297611741232"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eea34ce23dc3a595695856dc73bb132a9c5a2902",
"signature_type": "Line",
"target": {
"file": "drivers/scsi/lpfc/lpfc_els.c"
}
}
]