Guangwu Zhang

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.37 Description: A vulnerability in the Linux kernel has been resolved, related to the bnx2fc component. The issue arises from the improper use of spin lock bh when releasing resources after an upload, which can lead to a kernel bug and potentially cause a system crash. The vulnerability is due to the sequential nature of offload and upload calls, making the lock unnecessary. This vulnerability can be exploited to cause a denial of service. Recommendations: To resolve this issue, update the Linux kernel to version 6.6.37 or later. This update removes the unnecessary spin lock bh, preventing the kernel bug and potential system crash. Ensure that all affected systems are updated to this version or later to mitigate the risk of exploitation.

The issue is related to a buffer overread in the crypto component of the Linux kernel, specifically in the s390/aes module. When processing the last block, the s390 ctr code reads a whole block, even if there isn't a whole block of data left. This is fixed by using the actual length left and copying it into a buffer first for processing. The vulnerability may allow an attacker to cause a denial of service.

The vulnerability is related to the `bnx2fc` driver in the Linux kernel. The `bnx2fc destroy()` function removes the interface before calling `destroy work`, resulting in multiple warnings from `sysfs remove group()` as the controller rport device attributes are removed too early. This issue can be reproduced by following specific steps, including enabling `fcoe` and executing `fipvlan` and `fcoeadm` commands. The problem is caused by the removal of the `fcoe port`'s `destroy work` queue, which is not needed.