In the Linux kernel, the following vulnerability has been resolved:
scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs()
The following issue was observed running syzkaller:
BUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:377 [inline] BUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831 Read of size 2132 at addr ffff8880aea95dc8 by task syz-executor.0/9815
CPU: 0 PID: 9815 Comm: syz-executor.0 Not tainted 4.19.202-00874-gfc0fe04215a9 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xe4/0x14a lib/dump_stack.c:118 print_address_description+0x73/0x280 mm/kasan/report.c:253 kasan_report_error mm/kasan/report.c:352 [inline] kasan_report+0x272/0x370 mm/kasan/report.c:410 memcpy+0x1f/0x50 mm/kasan/kasan.c:302 memcpy include/linux/string.h:377 [inline] sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831 fill_from_dev_buffer+0x14f/0x340 drivers/scsi/scsi_debug.c:1021 resp_report_tgtpgs+0x5aa/0x770 drivers/scsi/scsi_debug.c:1772 schedule_resp+0x464/0x12f0 drivers/scsi/scsi_debug.c:4429 scsi_debug_queuecommand+0x467/0x1390 drivers/scsi/scsi_debug.c:5835 scsi_dispatch_cmd+0x3fc/0x9b0 drivers/scsi/scsi_lib.c:1896 scsi_request_fn+0x1042/0x1810 drivers/scsi/scsi_lib.c:2034 __blk_run_queue_uncond block/blk-core.c:464 [inline] __blk_run_queue+0x1a4/0x380 block/blk-core.c:484 blk_execute_rq_nowait+0x1c2/0x2d0 block/blk-exec.c:78 sg_common_write.isra.19+0xd74/0x1dc0 drivers/scsi/sg.c:847 sg_write.part.23+0x6e0/0xd00 drivers/scsi/sg.c:716 sg_write+0x64/0xa0 drivers/scsi/sg.c:622 __vfs_write+0xed/0x690 fs/read_write.c:485 kill_bdev:block_device:00000000e138492c vfs_write+0x184/0x4c0 fs/read_write.c:549 ksys_write+0x107/0x240 fs/read_write.c:599 do_syscall_64+0xc2/0x560 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe
We get 'alen' from command its type is int. If userspace passes a large length we will get a negative 'alen'.
Switch n, alen, and rlen to u32.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-toolsUpgrade kernel-livepatch-5.10.82-83.359Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade bpftool-debuginfoUpgrade python-perfUpgrade kernel-debuginfoUpgrade python-perf-debuginfoUpgrade perfUpgrade kernel-develUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernelUpgrade perf-debuginfoUpgrade kernel-headers | Aug 28, 2024 | Apr 10, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 10, 2024 |
| Dell Powerstore Dsa2024462 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Nov 20, 2024 |
| Dell Powerstore Dsa2024497 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Dec 19, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 10, 2024 |
| Suse | — | Upgrade kernel-debug-vdsoUpgrade kernel-rt-vdsoUpgrade kernel-default-optionalUpgrade kernel-rt-livepatchUpgrade kernel-defaultUpgrade dtb-renesasUpgrade dtb-mediatekUpgrade kernel-rt-extraUpgrade dtb-allwinnerUpgrade kernel-devel-rtUpgrade kernel-azureUpgrade kselftests-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade kernel-obs-buildUpgrade dlm-kmp-azureUpgrade reiserfs-kmp-azureUpgrade kernel-rt_debug-vdsoUpgrade kernel-docsUpgrade kernel-default-livepatch-develUpgrade kernel-source-vanillaUpgrade kernel-default-base-rebuildUpgrade dtb-xilinxUpgrade cluster-md-kmp-64kbUpgrade dtb-armUpgrade dtb-socionextUpgrade reiserfs-kmp-defaultUpgrade kernel-rt-livepatch-develUpgrade gfs2-kmp-defaultUpgrade kernel-default-baseUpgrade dlm-kmp-defaultUpgrade dtb-sprdUpgrade dlm-kmp-rtUpgrade kernel-syms-rtUpgrade ocfs2-kmp-azureUpgrade dtb-nvidiaUpgrade kernel-rt-develUpgrade kernel-64kb-extraUpgrade kernel-azure-vdsoUpgrade cluster-md-kmp-defaultUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-debug-livepatch-develUpgrade kselftests-kmp-rtUpgrade dtb-rockchipUpgrade kselftests-kmp-azureUpgrade kernel-docs-htmlUpgrade dtb-amdUpgrade dtb-lgUpgrade dtb-exynosUpgrade kernel-macrosUpgrade dtb-hisiliconUpgrade kernel-default-extraUpgrade kernel-64kb-livepatch-develUpgrade kernel-obs-qaUpgrade kernel-symsUpgrade kernel-kvmsmall-livepatch-develUpgrade ocfs2-kmp-rtUpgrade kernel-source-azureUpgrade kernel-default-vdsoUpgrade dtb-alteraUpgrade kernel-64kbUpgrade dtb-marvellUpgrade kernel-rt_debugUpgrade kernel-rt_debug-develUpgrade kernel-syms-azureUpgrade kselftests-kmp-64kbUpgrade dtb-amlogicUpgrade kernel-azure-optionalUpgrade dtb-appleUpgrade kernel-debug-develUpgrade cluster-md-kmp-rtUpgrade kernel-rtUpgrade kernel-default-develUpgrade kernel-azure-livepatch-develUpgrade dtb-qcomUpgrade ocfs2-kmp-defaultUpgrade kernel-64kb-optionalUpgrade kernel-azure-develUpgrade dtb-amazonUpgrade dtb-broadcomUpgrade reiserfs-kmp-64kbUpgrade kernel-source-rtUpgrade gfs2-kmp-64kbUpgrade kernel-debugUpgrade kernel-sourceUpgrade dtb-apmUpgrade kernel-kvmsmall-develUpgrade cluster-md-kmp-azureUpgrade kernel-zfcpdumpUpgrade dtb-caviumUpgrade kernel-azure-extraUpgrade ocfs2-kmp-64kbUpgrade kernel-rt-optionalUpgrade kernel-develUpgrade kernel-default-livepatchUpgrade dtb-freescaleUpgrade dlm-kmp-64kbUpgrade kernel-devel-azureUpgrade kernel-kvmsmall-vdsoUpgrade gfs2-kmp-azureUpgrade gfs2-kmp-rtUpgrade kernel-64kb-develUpgrade kernel-kvmsmall | Aug 9, 2024 | Apr 10, 2024 |
| Ubuntu | — | Upgrade linux-image-5.4.0-1129-raspiUpgrade linux-image-4.4.0-1181-awsUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-oem-osp1Upgrade linux-image-4.4.0-268-genericUpgrade linux-image-4.4.0-1113-fipsUpgrade linux-image-5.4.0-1147-azureUpgrade linux-image-ibmUpgrade linux-image-4.15.0-237-genericUpgrade linux-image-gcpUpgrade linux-image-aws-lts-20.04Upgrade linux-image-5.4.0-1145-gcp-fipsUpgrade linux-image-5.4.0-1101-bluefieldUpgrade linux-image-5.4.0-1142-awsUpgrade linux-image-5.4.0-1129-kvmUpgrade linux-image-oemUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-5.4.0-211-generic-lpaeUpgrade linux-image-aws-hweUpgrade linux-image-4.15.0-1188-azureUpgrade linux-image-5.4.0-1060-xilinx-zynqmpUpgrade linux-image-lowlatencyUpgrade linux-image-4.15.0-1173-gcpUpgrade linux-image-4.15.0-2081-gcp-fipsUpgrade linux-image-azure-lts-18.04Upgrade linux-image-5.4.0-1140-oracleUpgrade linux-image-4.4.0-1144-kvmUpgrade linux-image-5.4.0-1145-gcpUpgrade linux-image-raspiUpgrade linux-image-4.15.0-237-lowlatencyUpgrade linux-image-gcp-fipsUpgrade linux-image-azureUpgrade linux-image-5.4.0-211-lowlatencyUpgrade linux-image-4.15.0-2118-aws-fipsUpgrade linux-image-genericUpgrade linux-image-5.4.0-1147-azure-fipsUpgrade linux-image-4.15.0-2097-azure-fipsUpgrade linux-image-generic-lpaeUpgrade linux-image-oracle-lts-18.04Upgrade linux-image-4.15.0-1163-kvmUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-kvmUpgrade linux-image-awsUpgrade linux-image-azure-lts-20.04Upgrade linux-image-4.15.0-1135-fipsUpgrade linux-image-4.4.0-268-lowlatencyUpgrade linux-image-5.4.0-1116-fipsUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-fipsUpgrade linux-image-azure-fipsUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-5.4.0-1142-aws-fipsUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-bluefieldUpgrade linux-image-virtualUpgrade linux-image-raspi2Upgrade linux-image-virtual-lts-xenialUpgrade linux-image-5.4.0-1090-ibmUpgrade linux-image-generic-lts-xenialUpgrade linux-image-gkeUpgrade linux-image-aws-fipsUpgrade linux-image-gcp-lts-18.04Upgrade linux-image-4.15.0-1180-awsUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-5.4.0-211-genericUpgrade linux-image-4.15.0-1142-oracleUpgrade linux-image-4.4.0-1143-awsUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-generic-hwe-16.04Upgrade linux-image-virtual-hwe-16.04Upgrade linux-image-oracleUpgrade linux-image-5.4.0-1048-iotUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-aws-lts-18.04Upgrade linux-image-5.4.0-1088-ibmUpgrade linux-image-virtual-hwe-18.04 | Mar 31, 2025 | Apr 10, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 10, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub