Executive Summary

This vulnerability exists in the Linux kernel's SCSI generic (sg) driver. It involves the parameter def_reserved_size, which sets the default buffer size reserved for each Sg_fd. Although the kernel function sg_proc_write_dressz enforces a limit on this parameter between 0 and 1,048,576, it is possible to bypass this limit by directly modifying the module parameter to an invalid value (e.g., -1).

By setting def_reserved_size to an invalid value, opening the /dev/sgX device can cause a soft lockup, where the CPU becomes stuck for an extended period, effectively freezing the system or process. The issue arises because the invalid buffer size leads to improper handling in the sg driver functions, causing the system to hang.

The vulnerability was fixed by adding validation using module_param_cb to reject invalid values assigned to def_reserved_size, preventing the soft lockup condition.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a soft lockup in the Linux kernel when the /dev/sgX device is opened with an invalid buffer size parameter. A soft lockup means the CPU gets stuck for a significant amount of time, which can lead to system instability, unresponsiveness, or denial of service conditions.

If exploited, it could disrupt normal system operations, potentially affecting applications or services relying on the SCSI generic driver, causing them to hang or crash.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the module parameter def_reserved_size for the sg module has been set to an invalid value outside the allowed range (0 to 1,048,576). Specifically, if def_reserved_size is set to a negative value like -1, it can cause a soft lockup when opening /dev/sgX devices.

You can check the current value of def_reserved_size with the following command:

• cat /sys/module/sg/parameters/def_reserved_size

If the value is outside the valid range, it indicates the vulnerability might be triggered.

Additionally, attempting to open /dev/sgX with an invalid def_reserved_size can cause a soft lockup, which can be observed in system logs or by running commands that open the device, for example:

• exec 4<> /dev/sg0

Monitoring system logs for soft lockup messages related to the sg module or CPU stuck warnings can also help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that the module parameter def_reserved_size for the sg module is set within the valid range of 0 to 1,048,576.

Avoid manually setting def_reserved_size to invalid values such as negative numbers.

If you have control over kernel module parameters, reset def_reserved_size to a safe value by running:

• echo 65536 > /sys/module/sg/parameters/def_reserved_size

Additionally, update your Linux kernel to a version that includes the fix, which uses module_param_cb to validate and reject invalid values assigned to def_reserved_size.

Useful 0 Not Useful 0