In the Linux kernel, the following vulnerability has been resolved:
scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs()
The following issue was observed running syzkaller:
BUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:377 [inline] BUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831 Read of size 2132 at addr ffff8880aea95dc8 by task syz-executor.0/9815
CPU: 0 PID: 9815 Comm: syz-executor.0 Not tainted 4.19.202-00874-gfc0fe04215a9 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xe4/0x14a lib/dump_stack.c:118 print_address_description+0x73/0x280 mm/kasan/report.c:253 kasan_report_error mm/kasan/report.c:352 [inline] kasan_report+0x272/0x370 mm/kasan/report.c:410 memcpy+0x1f/0x50 mm/kasan/kasan.c:302 memcpy include/linux/string.h:377 [inline] sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831 fill_from_dev_buffer+0x14f/0x340 drivers/scsi/scsi_debug.c:1021 resp_report_tgtpgs+0x5aa/0x770 drivers/scsi/scsi_debug.c:1772 schedule_resp+0x464/0x12f0 drivers/scsi/scsi_debug.c:4429 scsi_debug_queuecommand+0x467/0x1390 drivers/scsi/scsi_debug.c:5835 scsi_dispatch_cmd+0x3fc/0x9b0 drivers/scsi/scsi_lib.c:1896 scsi_request_fn+0x1042/0x1810 drivers/scsi/scsi_lib.c:2034 __blk_run_queue_uncond block/blk-core.c:464 [inline] __blk_run_queue+0x1a4/0x380 block/blk-core.c:484 blk_execute_rq_nowait+0x1c2/0x2d0 block/blk-exec.c:78 sg_common_write.isra.19+0xd74/0x1dc0 drivers/scsi/sg.c:847 sg_write.part.23+0x6e0/0xd00 drivers/scsi/sg.c:716 sg_write+0x64/0xa0 drivers/scsi/sg.c:622 __vfs_write+0xed/0x690 fs/read_write.c:485 kill_bdev:block_device:00000000e138492c vfs_write+0x184/0x4c0 fs/read_write.c:549 ksys_write+0x107/0x240 fs/read_write.c:599 do_syscall_64+0xc2/0x560 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe
We get 'alen' from command its type is int. If userspace passes a large length we will get a negative 'alen'.
Switch n, alen, and rlen to u32.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-develUpgrade kernel-develUpgrade perfUpgrade perf-debuginfoUpgrade kernel-headersUpgrade kernelUpgrade kernel-debuginfo-common-aarch64Upgrade bpftool-debuginfoUpgrade kernel-debuginfoUpgrade kernel-toolsUpgrade kernel-livepatch-5.10.82-83.359Upgrade bpftoolUpgrade python-perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade python-perf | Aug 28, 2024 | Apr 10, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 10, 2024 |
| Dell Powerstore Dsa2024462 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Nov 20, 2024 |
| Dell Powerstore Dsa2024497 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Dec 19, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 10, 2024 |
| Suse | — | Upgrade kselftests-kmp-defaultUpgrade kernel-docsUpgrade kernel-rt-livepatchUpgrade dtb-renesasUpgrade kernel-rt-vdsoUpgrade dlm-kmp-azureUpgrade kernel-rt-livepatch-develUpgrade kernel-debug-vdsoUpgrade dtb-rockchipUpgrade kernel-rt_debug-livepatch-develUpgrade cluster-md-kmp-defaultUpgrade kernel-default-livepatch-develUpgrade kselftests-kmp-rtUpgrade reiserfs-kmp-rtUpgrade kernel-defaultUpgrade dtb-nvidiaUpgrade dtb-mediatekUpgrade reiserfs-kmp-azureUpgrade kernel-debug-livepatch-develUpgrade cluster-md-kmp-64kbUpgrade reiserfs-kmp-defaultUpgrade kernel-rt_debug-vdsoUpgrade kernel-64kb-extraUpgrade gfs2-kmp-defaultUpgrade kernel-syms-rtUpgrade dlm-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade kernel-default-baseUpgrade kernel-azure-vdsoUpgrade dtb-socionextUpgrade dlm-kmp-rtUpgrade kernel-obs-buildUpgrade dtb-armUpgrade dtb-sprdUpgrade kernel-default-base-rebuildUpgrade kernel-default-optionalUpgrade kernel-source-vanillaUpgrade dtb-xilinxUpgrade dtb-allwinnerUpgrade kernel-devel-rtUpgrade kernel-azureUpgrade kernel-rt-extraUpgrade kernel-rt-develUpgrade gfs2-kmp-azureUpgrade dtb-freescaleUpgrade dlm-kmp-64kbUpgrade ocfs2-kmp-defaultUpgrade cluster-md-kmp-rtUpgrade kernel-rtUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-livepatchUpgrade kernel-sourceUpgrade kernel-devel-azureUpgrade kernel-azure-develUpgrade kernel-rt_debug-develUpgrade kernel-rt_debugUpgrade kernel-source-azureUpgrade dtb-marvellUpgrade kernel-kvmsmall-develUpgrade kernel-default-extraUpgrade reiserfs-kmp-64kbUpgrade kernel-obs-qaUpgrade kernel-debugUpgrade dtb-amazonUpgrade dtb-exynosUpgrade dtb-appleUpgrade dtb-hisiliconUpgrade kernel-develUpgrade kernel-source-rtUpgrade gfs2-kmp-rtUpgrade kernel-rt-optionalUpgrade kernel-64kb-optionalUpgrade kernel-64kbUpgrade cluster-md-kmp-azureUpgrade kernel-syms-azureUpgrade dtb-broadcomUpgrade kernel-default-develUpgrade dtb-alteraUpgrade dtb-amlogicUpgrade kernel-64kb-livepatch-develUpgrade kernel-azure-optionalUpgrade dtb-lgUpgrade dtb-qcomUpgrade dtb-amdUpgrade kselftests-kmp-azureUpgrade kernel-azure-livepatch-develUpgrade dtb-apmUpgrade kernel-debug-develUpgrade kselftests-kmp-64kbUpgrade kernel-macrosUpgrade ocfs2-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-symsUpgrade kernel-zfcpdumpUpgrade kernel-azure-extraUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-64kb-develUpgrade dtb-caviumUpgrade kernel-kvmsmallUpgrade kernel-default-vdsoUpgrade kernel-docs-htmlUpgrade gfs2-kmp-64kb | Aug 9, 2024 | Apr 10, 2024 |
| Ubuntu | — | Upgrade linux-image-5.4.0-1145-gcp-fipsUpgrade linux-image-4.4.0-1144-kvmUpgrade linux-image-lowlatencyUpgrade linux-image-5.4.0-1129-kvmUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-4.15.0-1173-gcpUpgrade linux-image-aws-hweUpgrade linux-image-azure-lts-18.04Upgrade linux-image-genericUpgrade linux-image-4.15.0-237-genericUpgrade linux-image-5.4.0-1140-oracleUpgrade linux-image-4.15.0-1188-azureUpgrade linux-image-5.4.0-211-generic-lpaeUpgrade linux-image-4.15.0-2097-azure-fipsUpgrade linux-image-5.4.0-1101-bluefieldUpgrade linux-image-5.4.0-1129-raspiUpgrade linux-image-4.4.0-1113-fipsUpgrade linux-image-4.15.0-237-lowlatencyUpgrade linux-image-raspiUpgrade linux-image-4.15.0-2118-aws-fipsUpgrade linux-image-gcp-fipsUpgrade linux-image-ibmUpgrade linux-image-4.4.0-268-genericUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-5.4.0-1147-azure-fipsUpgrade linux-image-aws-lts-20.04Upgrade linux-image-5.4.0-211-lowlatencyUpgrade linux-image-4.4.0-1181-awsUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-5.4.0-1060-xilinx-zynqmpUpgrade linux-image-oem-osp1Upgrade linux-image-azureUpgrade linux-image-5.4.0-1142-awsUpgrade linux-image-5.4.0-1147-azureUpgrade linux-image-gcpUpgrade linux-image-4.15.0-2081-gcp-fipsUpgrade linux-image-oemUpgrade linux-image-5.4.0-1145-gcpUpgrade linux-image-4.15.0-1163-kvmUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-gcp-lts-18.04Upgrade linux-image-azure-fipsUpgrade linux-image-5.4.0-1048-iotUpgrade linux-image-raspi2Upgrade linux-image-4.4.0-1143-awsUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-generic-lts-xenialUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-raspi-hwe-18.04Upgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-5.4.0-1116-fipsUpgrade linux-image-virtual-hwe-16.04Upgrade linux-image-4.15.0-1142-oracleUpgrade linux-image-virtualUpgrade linux-image-bluefieldUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-aws-lts-18.04Upgrade linux-image-4.15.0-1180-awsUpgrade linux-image-4.15.0-1135-fipsUpgrade linux-image-gkeUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-aws-fipsUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-kvmUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-azure-lts-20.04Upgrade linux-image-5.4.0-1090-ibmUpgrade linux-image-fipsUpgrade linux-image-awsUpgrade linux-image-5.4.0-211-genericUpgrade linux-image-5.4.0-1142-aws-fipsUpgrade linux-image-generic-lpaeUpgrade linux-image-5.4.0-1088-ibmUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-4.4.0-268-lowlatencyUpgrade linux-image-oracleUpgrade linux-image-oracle-lts-18.04 | Mar 31, 2025 | Apr 10, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 10, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub