In the Linux kernel, the following vulnerability has been resolved:
scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs()
The following issue was observed running syzkaller:
BUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:377 [inline] BUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831 Read of size 2132 at addr ffff8880aea95dc8 by task syz-executor.0/9815
CPU: 0 PID: 9815 Comm: syz-executor.0 Not tainted 4.19.202-00874-gfc0fe04215a9 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xe4/0x14a lib/dump_stack.c:118 print_address_description+0x73/0x280 mm/kasan/report.c:253 kasan_report_error mm/kasan/report.c:352 [inline] kasan_report+0x272/0x370 mm/kasan/report.c:410 memcpy+0x1f/0x50 mm/kasan/kasan.c:302 memcpy include/linux/string.h:377 [inline] sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831 fill_from_dev_buffer+0x14f/0x340 drivers/scsi/scsi_debug.c:1021 resp_report_tgtpgs+0x5aa/0x770 drivers/scsi/scsi_debug.c:1772 schedule_resp+0x464/0x12f0 drivers/scsi/scsi_debug.c:4429 scsi_debug_queuecommand+0x467/0x1390 drivers/scsi/scsi_debug.c:5835 scsi_dispatch_cmd+0x3fc/0x9b0 drivers/scsi/scsi_lib.c:1896 scsi_request_fn+0x1042/0x1810 drivers/scsi/scsi_lib.c:2034 __blk_run_queue_uncond block/blk-core.c:464 [inline] __blk_run_queue+0x1a4/0x380 block/blk-core.c:484 blk_execute_rq_nowait+0x1c2/0x2d0 block/blk-exec.c:78 sg_common_write.isra.19+0xd74/0x1dc0 drivers/scsi/sg.c:847 sg_write.part.23+0x6e0/0xd00 drivers/scsi/sg.c:716 sg_write+0x64/0xa0 drivers/scsi/sg.c:622 __vfs_write+0xed/0x690 fs/read_write.c:485 kill_bdev:block_device:00000000e138492c vfs_write+0x184/0x4c0 fs/read_write.c:549 ksys_write+0x107/0x240 fs/read_write.c:599 do_syscall_64+0xc2/0x560 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe
We get 'alen' from command its type is int. If userspace passes a large length we will get a negative 'alen'.
Switch n, alen, and rlen to u32.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade python-perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-5.10.82-83.359Upgrade python-perfUpgrade kernel-debuginfoUpgrade kernel-toolsUpgrade perf-debuginfoUpgrade kernel-headersUpgrade perfUpgrade kernel-develUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel | Aug 28, 2024 | Apr 10, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 10, 2024 |
| Dell Powerstore Dsa2024462 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Nov 20, 2024 |
| Dell Powerstore Dsa2024497 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Dec 19, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 10, 2024 |
| Suse | — | Upgrade kernel-docsUpgrade kernel-default-baseUpgrade dlm-kmp-azureUpgrade kernel-syms-rtUpgrade kernel-default-livepatch-develUpgrade ocfs2-kmp-azureUpgrade kernel-rt_debug-vdsoUpgrade reiserfs-kmp-rtUpgrade kernel-64kb-extraUpgrade kernel-rt-livepatch-develUpgrade kselftests-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade dtb-nvidiaUpgrade reiserfs-kmp-defaultUpgrade kernel-devel-rtUpgrade kernel-default-optionalUpgrade dlm-kmp-rtUpgrade dtb-allwinnerUpgrade kernel-obs-buildUpgrade kernel-rt-extraUpgrade dtb-renesasUpgrade dtb-mediatekUpgrade kernel-defaultUpgrade kernel-default-base-rebuildUpgrade kernel-rt-livepatchUpgrade kernel-rt-vdsoUpgrade kernel-debug-vdsoUpgrade gfs2-kmp-defaultUpgrade dtb-sprdUpgrade dtb-armUpgrade reiserfs-kmp-azureUpgrade dtb-socionextUpgrade kernel-azure-vdsoUpgrade dlm-kmp-defaultUpgrade kernel-source-vanillaUpgrade dtb-xilinxUpgrade kselftests-kmp-rtUpgrade dtb-rockchipUpgrade kernel-debug-livepatch-develUpgrade kernel-rt_debug-livepatch-develUpgrade cluster-md-kmp-defaultUpgrade kernel-rt-develUpgrade kernel-azureUpgrade kernel-obs-qaUpgrade dlm-kmp-64kbUpgrade kernel-azure-optionalUpgrade kernel-rt-optionalUpgrade kernel-sourceUpgrade gfs2-kmp-azureUpgrade kernel-devel-azureUpgrade reiserfs-kmp-64kbUpgrade kernel-default-extraUpgrade kernel-source-rtUpgrade kernel-rtUpgrade kernel-docs-htmlUpgrade kernel-develUpgrade kernel-debugUpgrade dtb-broadcomUpgrade dtb-marvellUpgrade kernel-rt_debugUpgrade dtb-amlogicUpgrade kernel-64kb-livepatch-develUpgrade kernel-rt_debug-develUpgrade kernel-source-azureUpgrade kernel-default-develUpgrade ocfs2-kmp-defaultUpgrade kselftests-kmp-azureUpgrade dtb-lgUpgrade dtb-amdUpgrade dtb-qcomUpgrade kernel-syms-azureUpgrade kernel-azure-livepatch-develUpgrade kernel-64kb-optionalUpgrade dtb-appleUpgrade dtb-exynosUpgrade dtb-hisiliconUpgrade kernel-zfcpdumpUpgrade gfs2-kmp-rtUpgrade kernel-64kbUpgrade kernel-default-vdsoUpgrade dtb-alteraUpgrade ocfs2-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade kselftests-kmp-64kbUpgrade kernel-symsUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-caviumUpgrade kernel-64kb-develUpgrade kernel-kvmsmallUpgrade kernel-azure-extraUpgrade kernel-kvmsmall-develUpgrade kernel-macrosUpgrade dtb-amazonUpgrade dtb-freescaleUpgrade kernel-default-livepatchUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azure-develUpgrade cluster-md-kmp-rtUpgrade gfs2-kmp-64kbUpgrade dtb-apmUpgrade cluster-md-kmp-azureUpgrade kernel-debug-devel | Aug 9, 2024 | Apr 10, 2024 |
| Ubuntu | — | Upgrade linux-image-4.4.0-1113-fipsUpgrade linux-image-4.4.0-1144-kvmUpgrade linux-image-5.4.0-1145-gcp-fipsUpgrade linux-image-ibmUpgrade linux-image-oemUpgrade linux-image-5.4.0-1147-azureUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-5.4.0-1101-bluefieldUpgrade linux-image-5.4.0-1129-raspiUpgrade linux-image-4.15.0-1173-gcpUpgrade linux-image-aws-lts-20.04Upgrade linux-image-4.4.0-268-genericUpgrade linux-image-gcp-fipsUpgrade linux-image-azure-lts-18.04Upgrade linux-image-4.15.0-2097-azure-fipsUpgrade linux-image-4.15.0-2118-aws-fipsUpgrade linux-image-4.15.0-237-lowlatencyUpgrade linux-image-5.4.0-1060-xilinx-zynqmpUpgrade linux-image-5.4.0-1142-awsUpgrade linux-image-4.15.0-2081-gcp-fipsUpgrade linux-image-5.4.0-1145-gcpUpgrade linux-image-genericUpgrade linux-image-gcpUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-oem-osp1Upgrade linux-image-raspiUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-4.4.0-1181-awsUpgrade linux-image-5.4.0-211-generic-lpaeUpgrade linux-image-5.4.0-1129-kvmUpgrade linux-image-lowlatencyUpgrade linux-image-azureUpgrade linux-image-4.15.0-1188-azureUpgrade linux-image-5.4.0-211-lowlatencyUpgrade linux-image-5.4.0-1147-azure-fipsUpgrade linux-image-5.4.0-1140-oracleUpgrade linux-image-4.15.0-237-genericUpgrade linux-image-aws-hweUpgrade linux-image-4.4.0-1143-awsUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-kvmUpgrade linux-image-5.4.0-211-genericUpgrade linux-image-raspi2Upgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-generic-hwe-18.04Upgrade linux-image-4.4.0-268-lowlatencyUpgrade linux-image-4.15.0-1142-oracleUpgrade linux-image-5.4.0-1088-ibmUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-4.15.0-1135-fipsUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-generic-lts-xenialUpgrade linux-image-generic-lpaeUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-4.15.0-1180-awsUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-gcp-lts-18.04Upgrade linux-image-generic-hwe-16.04Upgrade linux-image-aws-fipsUpgrade linux-image-virtual-hwe-16.04Upgrade linux-image-gkeUpgrade linux-image-5.4.0-1142-aws-fipsUpgrade linux-image-oracleUpgrade linux-image-5.4.0-1048-iotUpgrade linux-image-5.4.0-1116-fipsUpgrade linux-image-4.15.0-1163-kvmUpgrade linux-image-oracle-lts-18.04Upgrade linux-image-bluefieldUpgrade linux-image-azure-fipsUpgrade linux-image-fipsUpgrade linux-image-5.4.0-1090-ibmUpgrade linux-image-aws-lts-18.04Upgrade linux-image-azure-lts-20.04Upgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-awsUpgrade linux-image-virtualUpgrade linux-image-xilinx-zynqmp | Mar 31, 2025 | Apr 10, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 10, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub