CVE-2022-49730

Summary

CVE-2022-44973 is a vulnerability affecting the Linux kernel that could lead to a use-after-free crash. Specifically, in the lpfc driver for SCSI devices, a null pointer dereference occurs when the discovery state machine is inadvertently called a second time after an ELS LOGO abortion. This results in the nodelist structure being freed and then a subsequent dereference of ndlp->vport->cfg_log_verbose in lpfc_nlp_get(). To mitigate this issue, lpfc_cmpl_els_logo() has been reworked to prevent duplicate calls and release the nodelist structure accordingly.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.