CVE-2021-47578

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.15.0-syzk #1

Description The vulnerability is related to a null pointer dereference in the scsi debug component of the Linux kernel. When the size argument to kcalloc() is zero, it returns ZERO SIZE PTR, which can cause a null pointer dereference in the memcpy function. This can lead to a denial of service. The vulnerability is exploited by calling kcalloc() with a size argument of zero, which returns ZERO SIZE PTR. The resp verify() and resp report zones() functions are affected.

Recommendations To resolve the issue, update the Linux kernel to a version that includes the fix for the scsi debug component. Specifically, update to a version later than 5.15.0-syzk #1. If an update is not available, consider disabling the scsi debug component or restricting access to the vulnerable resp verify() and resp report zones() functions until a patch is available.