CVE-2024-46843 scsi: ufs: core: Remove SCSI host only if added
A kernel panic occurs when removing the UFS driver if SCSI host addition failed, causing a denial of service in Linux systems with MCQ enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-46843?
CVE-2024-46843 is a medium-severity vulnerability in Linux kernel, published on 27 Sep 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: core: Remove SCSI host only if added
If host tries to remove ufshcd driver from a UFS device it would cause a kernel panic if ufshcd_async_scan fails during ufshcd_probe_hba before adding a SCSI host with scsi_add_host and MCQ is enabled since SCSI host has been defered after MCQ configuration introduced by commit 0cab4023ec7b ("scsi: ufs: core: Defer adding host to SCSI if MCQ is supported").
To guarantee that SCSI host is removed only if it has been added, set the scsi_host_added flag to true after adding a SCSI host and check whether it is set or not before removing it.
Which versions are affected by CVE-2024-46843?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-46843?
Apply the vendor's patch.
Is CVE-2024-46843 being exploited?
There is no known exploitation of CVE-2024-46843 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-50147, BELL-CVE-2024-46843, DEBIAN-CVE-2024-46843, GHSA-gxvh-f4g9-p9wp, ROOT-OS-DEBIAN-12-CVE-2024-46843, ROOT-OS-UBUNTU-2204-CVE-2024-46843 and 1 more.