From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 64C9614264C for ; Tue, 21 May 2024 14:39:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1716302392; cv=none; b=Icx2CN+pxODQQmmspiXDbV56IrzCpE+QhvXA9DAZqFANiIji1wit8+kb8JmrUN41SpvSw1QaSDUpovZsxS2IUuX+/ITdriZnYG8E2UFvdBhbKDD1eCvDHhbyNFmQ+9hSa1YEA3vo/Z6aWvyYZlk/FNIySzN+n48TWPtN3lUcm68= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1716302392; c=relaxed/simple; bh=9mOKgEWJTrfI0qGkoc2YI4xHbYxDplP6Q48uqS/p2lc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=hZz7fSlI65t1d2+RI8LQ7m60m8hJwsqNKedsf2nUmQl2dakFfa5gf4YiraDkCv4I95WxLY8sQAd5Q4dat9bAJWieG3qHjgCD67Sab3GNJytm2Z+T+TH1igpbqdLoIlnNyr8FTPH25DWKPBRCJmRMa7YHpAv1bEuNcYxbqsQo/lg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=dlX53rSz; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="dlX53rSz" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E27A6C2BD11; Tue, 21 May 2024 14:39:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1716302392; bh=9mOKgEWJTrfI0qGkoc2YI4xHbYxDplP6Q48uqS/p2lc=; h=From:To:Cc:Subject:Date:Reply-to:From; b=dlX53rSzlfgn3PEDn9itITV/nmgEgY7Vd6LbtJwz7q61DIFzBGKjTTGV2t/wRBIR6 AR1SfLcRrUnFp7bYvBRxWpPBqIoSWCUcq7w+gVPSBPKzhp71ojmI8MOWkgPmLDTgZw Dex0jqM7Q1rx1UPQ2VY2AZmKSIO1/bMZm521r5aY= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2021-47308: scsi: libfc: Fix array index out of bound exception Date: Tue, 21 May 2024 16:35:42 +0200 Message-ID: <2024052128-CVE-2021-47308-e3d8@gregkh> X-Mailer: git-send-email 2.45.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=2085; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=9mOKgEWJTrfI0qGkoc2YI4xHbYxDplP6Q48uqS/p2lc=; b=owGbwMvMwCRo6H6F97bub03G02pJDGk+Gw0cojnfvuuOdZrQ9cNt6hLd6M0lvBPMu3t0ZBKmK JppWF7oiGVhEGRikBVTZPmyjefo/opDil6Gtqdh5rAygQxh4OIUgIl8C2RYsF29KLjt+ZHj17wf G9qe3RQ1feWF6Qzzi1i7AmMPn0+c+HzXIr+v0zMW/a4TAgA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: scsi: libfc: Fix array index out of bound exception Fix array index out of bound exception in fc_rport_prli_resp(). The Linux kernel CVE team has assigned CVE-2021-47308 to this issue. Affected and fixed versions =========================== Fixed in 4.14.241 with commit 44651522941c Fixed in 4.19.199 with commit 4921b1618045 Fixed in 5.4.135 with commit 0fe70c15f943 Fixed in 5.10.53 with commit a4a54c54af25 Fixed in 5.13.5 with commit 8511293e643a Fixed in 5.14 with commit b27c45775570 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2021-47308 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/scsi/libfc/fc_rport.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/44651522941c623e20882b3b443f23f77de1ea8b https://git.kernel.org/stable/c/4921b1618045ffab71b1050bf0014df3313a2289 https://git.kernel.org/stable/c/0fe70c15f9435bb3c50954778245d62ee38b0e03 https://git.kernel.org/stable/c/a4a54c54af2516caa9c145015844543cfc84316a https://git.kernel.org/stable/c/8511293e643a18b248510ae5734e4f360754348c https://git.kernel.org/stable/c/b27c4577557045f1ab3cdfeabfc7f3cd24aca1fe