In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check
qla_chk_edif_rx_sa_delete_pending() obtains the SCSI command via
GET_CMD_SP(sp) and immediately dereferences cmd->sc_data_direction.
That command pointer can be NULL: the firmware may post a status
completion for a command that has already been returned or aborted. The
caller qla2x00_status_entry() acknowledges this on the very same status
path, re-fetching GET_CMD_SP(sp) and bailing out with the "Command
already returned" message when it is NULL -- but that check runs only
after qla_chk_edif_rx_sa_delete_pending() has already dereferenced the
pointer, so a NULL cmd crashes the kernel in interrupt context.
Return early when cmd is NULL, before touching cmd->sc_data_direction.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 7.5
AV:N - qla_chk_edif_rx_sa_delete_pending() runs from qla2x00_status_entry() on STATUS_TYPE IOCBs the HBA firmware posts from a remote Fibre Channel or FCoE target's FCP_RSP. QLogic CNAs speak FCoE and SAN fabrics are stretched via FCIP, so a compromised target delivers late completions over the storage network with no local access.
AC:L - A hostile target controls FCP_RSP timing and can delay a response until SCSI error handling aborts and returns the command, then complete so firmware posts status for a NULL cmd. The same function already handles that case ("Command already returned"); the crash is then deterministic and needs no rare config or layout beyond a qla2xxx HBA.
PR:N - Completions are handled in the HBA interrupt/response-queue path (qla24xx_process_response_queue to qla2x00_status_entry) with no Linux credential or capability check; the attacker only needs to act as an FC/FCoE target on the fabric.
UI:N - Once the target is visible on the fabric, the SCSI midlayer automatically issues commands (scan, path checks, mounted-filesystem I/O) whose STATUS_TYPE completions take the vulnerable path; no user mount, open, or other interactive step is required at exploit time.
S:U - The NULL dereference and resulting oops stay inside the host kernel that owns the qla2xxx driver and do not cross a VM, IOMMU, or other separate security authority.
C:N - This is a pure NULL-pointer dereference of GET_CMD_SP(sp) (cmd->sc_data_direction at a NULL-page offset) when the SCSI command was already returned or aborted. There is no use-after-free of a live object, out-of-bounds read, or other kernel memory disclosure primitive.
I:N - The cmd pointer is NULL, not a freed or attacker-controlled object, so the load cannot corrupt kernel heap, overwrite function pointers, or hijack control flow. The fix is only an early NULL return; there is no write primitive.
A:H - Dereferencing NULL cmd in qla_chk_edif_rx_sa_delete_pending() from the response-queue interrupt or qla_do_work() context oopses or panics the host, taking down all storage served by the adapter. A fabric peer can repeat this on aborted I/O.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
None |
| Privileges Required |
None |
Integrity Impact |
None |
| User Interaction |
None |
Availability Impact |
High |
AV:N - qla_chk_edif_rx_sa_delete_pending() runs from qla2x00_status_entry() on STATUS_TYPE IOCBs the HBA firmware posts from a remote Fibre Channel or FCoE target's FCP_RSP. QLogic CNAs speak FCoE and SAN fabrics are stretched via FCIP, so a compromised target delivers late completions over the storage network with no local access.
AC:L - A hostile target controls FCP_RSP timing and can delay a response until SCSI error handling aborts and returns the command, then complete so firmware posts status for a NULL cmd. The same function already handles that case ("Command already returned"); the crash is then deterministic and needs no rare config or layout beyond a qla2xxx HBA.
PR:N - Completions are handled in the HBA interrupt/response-queue path (qla24xx_process_response_queue to qla2x00_status_entry) with no Linux credential or capability check; the attacker only needs to act as an FC/FCoE target on the fabric.
UI:N - Once the target is visible on the fabric, the SCSI midlayer automatically issues commands (scan, path checks, mounted-filesystem I/O) whose STATUS_TYPE completions take the vulnerable path; no user mount, open, or other interactive step is required at exploit time.
S:U - The NULL dereference and resulting oops stay inside the host kernel that owns the qla2xxx driver and do not cross a VM, IOMMU, or other separate security authority.
C:N - This is a pure NULL-pointer dereference of GET_CMD_SP(sp) (cmd->sc_data_direction at a NULL-page offset) when the SCSI command was already returned or aborted. There is no use-after-free of a live object, out-of-bounds read, or other kernel memory disclosure primitive.
I:N - The cmd pointer is NULL, not a freed or attacker-controlled object, so the load cannot corrupt kernel heap, overwrite function pointers, or hijack control flow. The fix is only an early NULL return; there is no write primitive.
A:H - Dereferencing NULL cmd in qla_chk_edif_rx_sa_delete_pending() from the response-queue interrupt or qla_do_work() context oopses or panics the host, taking down all storage served by the adapter. A fabric peer can repeat this on aborted I/O.
CVSS 3.1