industrial-control-system-vulnerabilityend-of-life-software

Linux lpfc Driver Race Leaves NPIV Fibre Channel Sessions Stale

Vulnerability Disclosure · 3 sources · Updated 3mo ago · First seen Aug 8, 2024

CVE-2024-36952 is a moderate-severity flaw in the Linux kernel's lpfc SCSI driver affecting its NPIV virtual-port cleanup path. A race condition can unregister a virtual port and free its remote-port object before the driver sends its final Remove All DA_ID CT and LOGO ELS requests, causing a Fibre Channel fabric switch to retain an incorrect logged-in NPIV session state.

Red Hat rated the issue CVSS v3.1 4.4 and released fixes for supported Red Hat Enterprise Linux 8 and 9 streams; RHEL 6 and 7 are outside support scope. The correction defers fc_remove_host() and scsi_remove_host() until after the DA_ID and LOGO messages are transmitted, addressing an incomplete-cleanup condition consistent with CWE-459.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

6 events · Jul 10, 2024 – Aug 8, 2024

Reported Aug 8, 20242y ago
Red Hat fixes CVE-2024-36952 in RHEL 8.8 EUS
Red Hat released a fixed kernel for RHEL 8.8 Extended Update Support through RHSA-2024:8107.
CVE-2024-36952 - Red Hat Customer Portal
Aug 8, 20242y ago
Red Hat releases RHEL 8 kernel fix for CVE-2024-36952
Red Hat released a fixed RHEL 8 kernel through RHSA-2024:5101.
CVE-2024-36952 - Red Hat Customer Portal
Jul 31, 20242y ago
Red Hat releases RHEL 9 kernel fix for CVE-2024-36952
Red Hat released a fixed RHEL 9 kernel through RHSA-2024:4928.
CVE-2024-36952 - Red Hat Customer Portal
Jul 24, 20242y ago
Red Hat fixes CVE-2024-36952 in RHEL 9.2 EUS
Red Hat issued fixed kernel and kernel-rt packages for RHEL 9.2 Extended Update Support via RHSA-2024:4823 and RHSA-2024:4831.
CVE-2024-36952 - Red Hat Customer Portal
Jul 10, 20242y ago
Red Hat releases RHEL 8.6 stream fix for CVE-2024-36952
Red Hat released a fixed kernel for RHEL 8.6 Advanced Mission Critical Update Support, Telecommunications Update Service, and Update Services for SAP Solutions through RHSA-2024:4447.
CVE-2024-36952 - Red Hat Customer Portal
Reported May 30, 20242y ago
Linux kernel CVE team discloses and fixes CVE-2024-36952
The Linux kernel CVE team assigned CVE-2024-36952 for a race in the SCSI lpfc driver's NPIV virtual-port deletion path that could skip final DA_ID and LOGO fabric requests. Fixes moved host unregistration after cleanup and fabric notifications, and were included in kernel versions 5.15.159, 6.1.91, 6.6.31, 6.8.10, and 6.9.
CVE-2024-36952: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Incomplete NPIV cleanup in the Linux kernel lpfc driver (CVE-2024-36952)

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Redhat OtherNews · Aug 8, 2024

CVE-2024-36952 - Red Hat Customer PortalOpen source ↗

Lore KernelNews · May 30, 2024

CVE-2024-36952: scsi: lpfc: Move NPIV's transport unregistration to after resource clean upOpen source ↗

Cwe MitreNews · Sep 9, 2008

CWE - CWE-459: Incomplete Cleanup (4.20)Open source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Linux lpfc Driver Race Leaves NPIV Fibre Channel Sessions Stale

Vulnerability Disclosure · 3 sources · Updated 3mo ago · First seen Aug 8, 2024

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Linux lpfc Driver Race Leaves NPIV Fibre Channel Sessions Stale

How this story unfolded

Red Hat fixes CVE-2024-36952 in RHEL 8.8 EUS

Red Hat releases RHEL 8 kernel fix for CVE-2024-36952

Red Hat releases RHEL 9 kernel fix for CVE-2024-36952

Red Hat fixes CVE-2024-36952 in RHEL 9.2 EUS

Red Hat releases RHEL 8.6 stream fix for CVE-2024-36952

Linux kernel CVE team discloses and fixes CVE-2024-36952

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Linux lpfc Driver Race Leaves NPIV Fibre Channel Sessions Stale

How this story unfolded

Red Hat fixes CVE-2024-36952 in RHEL 8.8 EUS

Red Hat releases RHEL 8 kernel fix for CVE-2024-36952

Red Hat releases RHEL 9 kernel fix for CVE-2024-36952

Red Hat fixes CVE-2024-36952 in RHEL 9.2 EUS

Red Hat releases RHEL 8.6 stream fix for CVE-2024-36952

Linux kernel CVE team discloses and fixes CVE-2024-36952

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.