In the Linux kernel, the following vulnerability has been resolved:
scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs()
The following issue was observed running syzkaller:
BUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:377 [inline] BUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831 Read of size 2132 at addr ffff8880aea95dc8 by task syz-executor.0/9815
CPU: 0 PID: 9815 Comm: syz-executor.0 Not tainted 4.19.202-00874-gfc0fe04215a9 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xe4/0x14a lib/dump_stack.c:118 print_address_description+0x73/0x280 mm/kasan/report.c:253 kasan_report_error mm/kasan/report.c:352 [inline] kasan_report+0x272/0x370 mm/kasan/report.c:410 memcpy+0x1f/0x50 mm/kasan/kasan.c:302 memcpy include/linux/string.h:377 [inline] sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831 fill_from_dev_buffer+0x14f/0x340 drivers/scsi/scsi_debug.c:1021 resp_report_tgtpgs+0x5aa/0x770 drivers/scsi/scsi_debug.c:1772 schedule_resp+0x464/0x12f0 drivers/scsi/scsi_debug.c:4429 scsi_debug_queuecommand+0x467/0x1390 drivers/scsi/scsi_debug.c:5835 scsi_dispatch_cmd+0x3fc/0x9b0 drivers/scsi/scsi_lib.c:1896 scsi_request_fn+0x1042/0x1810 drivers/scsi/scsi_lib.c:2034 __blk_run_queue_uncond block/blk-core.c:464 [inline] __blk_run_queue+0x1a4/0x380 block/blk-core.c:484 blk_execute_rq_nowait+0x1c2/0x2d0 block/blk-exec.c:78 sg_common_write.isra.19+0xd74/0x1dc0 drivers/scsi/sg.c:847 sg_write.part.23+0x6e0/0xd00 drivers/scsi/sg.c:716 sg_write+0x64/0xa0 drivers/scsi/sg.c:622 __vfs_write+0xed/0x690 fs/read_write.c:485 kill_bdev:block_device:00000000e138492c vfs_write+0x184/0x4c0 fs/read_write.c:549 ksys_write+0x107/0x240 fs/read_write.c:599 do_syscall_64+0xc2/0x560 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe
We get 'alen' from command its type is int. If userspace passes a large length we will get a negative 'alen'.
Switch n, alen, and rlen to u32.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-develUpgrade perf-debuginfoUpgrade kernel-headersUpgrade kernelUpgrade perfUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-livepatch-5.10.82-83.359Upgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade python-perf | Aug 28, 2024 | Apr 10, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 10, 2024 |
| Dell Powerstore Dsa2024462 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Nov 20, 2024 |
| Dell Powerstore Dsa2024497 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Dec 19, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 10, 2024 |
| Suse | — | Upgrade kernel-obs-qaUpgrade reiserfs-kmp-64kbUpgrade kernel-source-rtUpgrade kernel-azure-develUpgrade kernel-devel-azureUpgrade dtb-amazonUpgrade kselftests-kmp-azureUpgrade kernel-source-azureUpgrade kernel-azure-livepatch-develUpgrade kernel-rt_debug-develUpgrade kernel-64kb-optionalUpgrade kernel-syms-azureUpgrade dtb-marvellUpgrade kernel-default-extraUpgrade dtb-freescaleUpgrade dtb-amdUpgrade kernel-rtUpgrade kernel-kvmsmall-vdsoUpgrade kernel-debugUpgrade kernel-kvmsmall-develUpgrade dtb-lgUpgrade gfs2-kmp-azureUpgrade gfs2-kmp-64kbUpgrade kernel-debug-develUpgrade kernel-zfcpdumpUpgrade kernel-64kb-develUpgrade kselftests-kmp-64kbUpgrade cluster-md-kmp-azureUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-qcomUpgrade kernel-default-develUpgrade dtb-alteraUpgrade kernel-rt-optionalUpgrade kernel-64kbUpgrade ocfs2-kmp-64kbUpgrade ocfs2-kmp-rtUpgrade dtb-exynosUpgrade kernel-sourceUpgrade kernel-symsUpgrade kernel-azure-extraUpgrade dtb-hisiliconUpgrade kernel-develUpgrade dtb-broadcomUpgrade dtb-appleUpgrade dlm-kmp-64kbUpgrade kernel-kvmsmallUpgrade kernel-azure-optionalUpgrade kernel-macrosUpgrade cluster-md-kmp-rtUpgrade dtb-apmUpgrade dtb-amlogicUpgrade dtb-caviumUpgrade kernel-64kb-livepatch-develUpgrade kernel-docs-htmlUpgrade ocfs2-kmp-defaultUpgrade kernel-default-livepatchUpgrade gfs2-kmp-rtUpgrade kernel-default-vdsoUpgrade kernel-rt_debugUpgrade kernel-azureUpgrade kernel-syms-rtUpgrade kernel-rt-vdsoUpgrade dtb-renesasUpgrade dtb-rockchipUpgrade reiserfs-kmp-rtUpgrade cluster-md-kmp-64kbUpgrade kernel-rt-livepatch-develUpgrade reiserfs-kmp-azureUpgrade reiserfs-kmp-defaultUpgrade kernel-rt_debug-vdsoUpgrade dtb-nvidiaUpgrade kernel-azure-vdsoUpgrade kernel-docsUpgrade kernel-debug-livepatch-develUpgrade kernel-rt_debug-livepatch-develUpgrade cluster-md-kmp-defaultUpgrade kselftests-kmp-rtUpgrade kernel-default-optionalUpgrade kernel-rt-extraUpgrade kernel-devel-rtUpgrade kselftests-kmp-defaultUpgrade dtb-allwinnerUpgrade kernel-default-livepatch-develUpgrade dlm-kmp-azureUpgrade kernel-64kb-extraUpgrade dtb-socionextUpgrade dtb-armUpgrade kernel-rt-develUpgrade kernel-source-vanillaUpgrade dtb-xilinxUpgrade kernel-default-base-rebuildUpgrade dtb-sprdUpgrade kernel-debug-vdsoUpgrade kernel-rt-livepatchUpgrade dlm-kmp-rtUpgrade ocfs2-kmp-azureUpgrade kernel-obs-buildUpgrade kernel-default-baseUpgrade gfs2-kmp-defaultUpgrade kernel-defaultUpgrade dlm-kmp-defaultUpgrade dtb-mediatek | Aug 9, 2024 | Apr 10, 2024 |
| Ubuntu | — | Upgrade linux-image-5.4.0-1129-raspiUpgrade linux-image-5.4.0-211-generic-lpaeUpgrade linux-image-4.15.0-2081-gcp-fipsUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-azure-lts-18.04Upgrade linux-image-4.4.0-268-genericUpgrade linux-image-aws-lts-20.04Upgrade linux-image-5.4.0-1142-awsUpgrade linux-image-4.15.0-2097-azure-fipsUpgrade linux-image-5.4.0-1147-azureUpgrade linux-image-5.4.0-1101-bluefieldUpgrade linux-image-4.15.0-237-genericUpgrade linux-image-4.15.0-237-lowlatencyUpgrade linux-image-5.4.0-1147-azure-fipsUpgrade linux-image-5.4.0-1145-gcpUpgrade linux-image-raspiUpgrade linux-image-4.15.0-2118-aws-fipsUpgrade linux-image-5.4.0-1145-gcp-fipsUpgrade linux-image-oem-osp1Upgrade linux-image-oracle-lts-20.04Upgrade linux-image-4.4.0-1144-kvmUpgrade linux-image-5.4.0-1140-oracleUpgrade linux-image-5.4.0-1129-kvmUpgrade linux-image-aws-hweUpgrade linux-image-5.4.0-1060-xilinx-zynqmpUpgrade linux-image-oemUpgrade linux-image-5.4.0-211-lowlatencyUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-gcp-fipsUpgrade linux-image-lowlatencyUpgrade linux-image-4.15.0-1188-azureUpgrade linux-image-azureUpgrade linux-image-gcpUpgrade linux-image-4.4.0-1181-awsUpgrade linux-image-ibmUpgrade linux-image-genericUpgrade linux-image-4.4.0-1113-fipsUpgrade linux-image-4.15.0-1173-gcpUpgrade linux-image-bluefieldUpgrade linux-image-5.4.0-1142-aws-fipsUpgrade linux-image-5.4.0-1116-fipsUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-azure-lts-20.04Upgrade linux-image-4.15.0-1135-fipsUpgrade linux-image-generic-lpaeUpgrade linux-image-5.4.0-1088-ibmUpgrade linux-image-4.4.0-268-lowlatencyUpgrade linux-image-generic-lts-xenialUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-gcp-lts-20.04Upgrade linux-image-4.15.0-1163-kvmUpgrade linux-image-5.4.0-1048-iotUpgrade linux-image-oracleUpgrade linux-image-azure-fipsUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-aws-fipsUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-gcp-lts-18.04Upgrade linux-image-virtual-hwe-16.04Upgrade linux-image-gkeUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-fipsUpgrade linux-image-4.15.0-1142-oracleUpgrade linux-image-aws-lts-18.04Upgrade linux-image-5.4.0-211-genericUpgrade linux-image-raspi2Upgrade linux-image-5.4.0-1090-ibmUpgrade linux-image-4.15.0-1180-awsUpgrade linux-image-kvmUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-4.4.0-1143-awsUpgrade linux-image-virtualUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-awsUpgrade linux-image-oracle-lts-18.04 | Mar 31, 2025 | Apr 10, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 10, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub