scsi: target: Fix WRITE_SAME No Data Buffer crash
Summary
| CVE | CVE-2022-21546 |
|---|---|
| State | PUBLISHED |
| Assigner | oracle |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2025-05-02 22:15:15 UTC |
| Updated | 2026-08-04 10:17:13 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix WRITE_SAME No Data Buffer crash In newer version of the SBC specs, we have a NDOB bit that indicates there is no data buffer that gets written out. If this bit is set using commands like "sg_write_same --ndob" we will crash in target_core_iblock/file's execute_write_same handlers when we go to access the se_cmd->t_data_sg because its NULL. This patch adds a check for the NDOB bit in the common WRITE SAME code because we don't support it. And, it adds a check for zero SG elements in each handler in case the initiator tries to send a normal WRITE SAME with no data buffer. |
Risk And Classification
Primary CVSS: v3.1 7.8 HIGH from [email protected]
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Problem Types: CWE-476 | CWE-476 CWE-476 NULL Pointer Dereference
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | Secondary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | CNA | DECLARED | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Linux | Linux Kernel | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected f6970ad31d42fceb38b5595cbad093a4d0bfcc43 54e57be2573cf0b8bf650375fd8752987b6c3d3b git | Not specified |
| CNA | Linux | Linux | affected f6970ad31d42fceb38b5595cbad093a4d0bfcc43 d8e6a27e9238dd294d6f2f401655f300dca20899 git | Not specified |
| CNA | Linux | Linux | affected f6970ad31d42fceb38b5595cbad093a4d0bfcc43 4226622647e3e5ac06d3ebc1605b917446157510 git | Not specified |
| CNA | Linux | Linux | affected f6970ad31d42fceb38b5595cbad093a4d0bfcc43 ccd3f449052449a917a3e577d8ba0368f43b8f29 git | Not specified |
| CNA | Linux | Linux | affected 3.8 | Not specified |
| CNA | Linux | Linux | unaffected 3.8 semver | Not specified |
| CNA | Linux | Linux | unaffected 5.4.294 5.4.* semver | Not specified |
| CNA | Linux | Linux | unaffected 5.10.238 5.10.* semver | Not specified |
| CNA | Linux | Linux | unaffected 5.15.182 5.15.* semver | Not specified |
| CNA | Linux | Linux | unaffected 5.19 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/d8e6a27e9238dd294d6f2f401655f300dca20899 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | Patch |
| git.kernel.org/stable/c/4226622647e3e5ac06d3ebc1605b917446157510 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | Patch |
| git.kernel.org/stable/c/ccd3f449052449a917a3e577d8ba0368f43b8f29 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | Patch |
| git.kernel.org/stable/c/54e57be2573cf0b8bf650375fd8752987b6c3d3b | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | Patch |
| lists.debian.org/debian-lts-announce/2025/10/msg00007.html | af854a3a-2127-422b-91ae-364da2661108 | lists.debian.org | Mailing List |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 160076 Oracle Enterprise Linux Security Update for unbreakable enterprise kernel (ELSA-2022-9761)
- 160098 Oracle Enterprise Linux Security Update for unbreakable enterprise kernel (ELSA-2022-9787)
- 160099 Oracle Enterprise Linux Security Update for unbreakable enterprise kernel-container (ELSA-2022-9788)
- 160106 Oracle Enterprise Linux Security Update for unbreakable enterprise kernel (ELSA-2022-9827)
- 160107 Oracle Enterprise Linux Security Update for unbreakable enterprise kernel (ELSA-2022-9828)
- 160108 Oracle Enterprise Linux Security Update for unbreakable enterprise kernel-container (ELSA-2022-9829)
- 160109 Oracle Enterprise Linux Security Update for unbreakable enterprise kernel-container (ELSA-2022-9830)
- 390267 Oracle VM Server for x86 Security Update for kernel (OVMSA-2022-0024)