In the Linux kernel, the following vulnerability has been resolved:
scsi: lpfc: Resolve NULL ptr dereference after an ELS LOGO is aborted
A use-after-free crash can occur after an ELS LOGO is aborted.
Specifically, a nodelist structure is freed and then ndlp->vport->cfglogverbose is dereferenced in lpfcnlpget() when the discovery state machine is mistakenly called a second time with NLPEVTDEVICE_RM argument.
Rework lpfccmplels_logo() to prevent the duplicate calls to release a nodelist structure.
{ "vanir_signatures": [ { "signature_type": "Line", "target": { "file": "drivers/scsi/lpfc/lpfc_els.c" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "261090575386277878807812483873611475738", "233251153309802705923465037398096675021", "81645605219366739017527393097158178109", "113784717649141474982725648551744476788", "61746974526404243546071485430857279259", "334174367268215360875263957782309975667", "24176860832770406059524594201747711806", "97014055769086657776820825880375847360", "209091900606049461375330208969833764707", "239468178350444378886815689381937680680", "240990622185841265892364864825097789701", "137214841023198471230601240033074413191", "122355787091232024149045229859937458563", "232380703512278964216514861856220861605", "146292083286979978287209402092170078617", "57990775736622892913807340853122359019", "259840338650111321794434730161104728846", "197230037737383884840711673297611741232" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e83869e29448958f8ae2c6911f350318f75e4fc", "deprecated": false, "id": "CVE-2022-49730-23cbeebf" }, { "signature_type": "Function", "target": { "file": "drivers/scsi/lpfc/lpfc_els.c", "function": "lpfc_cmpl_els_logo" }, "signature_version": "v1", "digest": { "length": 2450.0, "function_hash": "229825258632661695683220242435728519014" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eea34ce23dc3a595695856dc73bb132a9c5a2902", "deprecated": false, "id": "CVE-2022-49730-34ef1261" }, { "signature_type": "Function", "target": { "file": "drivers/scsi/lpfc/lpfc_els.c", "function": "lpfc_cmpl_els_logo" }, "signature_version": "v1", "digest": { "length": 2473.0, "function_hash": "31985031615911374827021119274642539347" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b1b3440f437b75fb2a9b0cfe58df461e40eca474", "deprecated": false, "id": "CVE-2022-49730-5b21bb3f" }, { "signature_type": "Line", "target": { "file": "drivers/scsi/lpfc/lpfc_els.c" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "231265855216076113144088752586745024479", "30949778293455480201270438145365733495", "68514581814722883891262953143231312277", "291700319643095666004176807040048915698", "205018024964935473990897882604893322743", "178873939191715418601036655327513169898", "261090575386277878807812483873611475738", "233251153309802705923465037398096675021", "81645605219366739017527393097158178109", "113784717649141474982725648551744476788", "61746974526404243546071485430857279259", "334174367268215360875263957782309975667", "24176860832770406059524594201747711806", "97014055769086657776820825880375847360", "209091900606049461375330208969833764707", "239468178350444378886815689381937680680", "52453943400154075095299020614871672591", "152478949861551383383896336527679650561", "106322008575550556015334758652253761158", "232380703512278964216514861856220861605", "146292083286979978287209402092170078617", "57990775736622892913807340853122359019", "259840338650111321794434730161104728846", "197230037737383884840711673297611741232" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b1b3440f437b75fb2a9b0cfe58df461e40eca474", "deprecated": false, "id": "CVE-2022-49730-5bc3a7fa" }, { "signature_type": "Function", "target": { "file": "drivers/scsi/lpfc/lpfc_els.c", "function": "lpfc_cmpl_els_logo" }, "signature_version": "v1", "digest": { "length": 2408.0, "function_hash": "219122278733224621901939049656185541693" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e83869e29448958f8ae2c6911f350318f75e4fc", "deprecated": false, "id": "CVE-2022-49730-6a147f97" }, { "signature_type": "Line", "target": { "file": "drivers/scsi/lpfc/lpfc_els.c" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "261090575386277878807812483873611475738", "233251153309802705923465037398096675021", "81645605219366739017527393097158178109", "113784717649141474982725648551744476788", "61746974526404243546071485430857279259", "334174367268215360875263957782309975667", "24176860832770406059524594201747711806", "97014055769086657776820825880375847360", "209091900606049461375330208969833764707", "239468178350444378886815689381937680680", "52453943400154075095299020614871672591", "152478949861551383383896336527679650561", "106322008575550556015334758652253761158", "232380703512278964216514861856220861605", "146292083286979978287209402092170078617", "57990775736622892913807340853122359019", "259840338650111321794434730161104728846", "197230037737383884840711673297611741232" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eea34ce23dc3a595695856dc73bb132a9c5a2902", "deprecated": false, "id": "CVE-2022-49730-a1cd22c8" } ] }