CVE-2022-21546

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-21546
In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix WRITE_SAME No Data Buffer crash In newer version of the SBC specs, we have a NDOB bit that indicates there is no data buffer that gets written out. If this bit is set using commands like "sg_write_same --ndob" we will crash in target_core_iblock/file's execute_write_same handlers when we go to access the se_cmd->t_data_sg because its NULL. This patch adds a check for the NDOB bit in the common WRITE SAME code because we don't support it. And, it adds a check for zero SG elements in each handler in case the initiator tries to send a normal WRITE SAME with no data buffer.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/4226622647e3e5ac06d3ebc1605b917446157510 Patch
https://git.kernel.org/stable/c/54e57be2573cf0b8bf650375fd8752987b6c3d3b Patch
https://git.kernel.org/stable/c/ccd3f449052449a917a3e577d8ba0368f43b8f29 Patch
https://git.kernel.org/stable/c/d8e6a27e9238dd294d6f2f401655f300dca20899 Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html Mailing List
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:rc6:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

10 Nov 2025, 17:37

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
First Time Linux
Debian
Debian debian Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:5.19:rc5:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:rc4:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/4226622647e3e5ac06d3ebc1605b917446157510 - () https://git.kernel.org/stable/c/4226622647e3e5ac06d3ebc1605b917446157510 - Patch
References () https://git.kernel.org/stable/c/54e57be2573cf0b8bf650375fd8752987b6c3d3b - () https://git.kernel.org/stable/c/54e57be2573cf0b8bf650375fd8752987b6c3d3b - Patch
References () https://git.kernel.org/stable/c/ccd3f449052449a917a3e577d8ba0368f43b8f29 - () https://git.kernel.org/stable/c/ccd3f449052449a917a3e577d8ba0368f43b8f29 - Patch
References () https://git.kernel.org/stable/c/d8e6a27e9238dd294d6f2f401655f300dca20899 - () https://git.kernel.org/stable/c/d8e6a27e9238dd294d6f2f401655f300dca20899 - Patch
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - Mailing List

03 Nov 2025, 18:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html -

04 Jun 2025, 13:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 7.7 		v2 : unknown
v3 : unknown
References
  • {'url': 'https://git.kernel.org/linus/ccd3f449052449a917a3e577d8ba0368f43b8f29', 'source': 'secalert_us@oracle.com'}
  • {'url': 'https://linux.oracle.com/cve/CVE-2022-21546.html', 'source': 'secalert_us@oracle.com'}
  • {'url': 'https://lore.kernel.org/all/20220628022325.14627-2-michael.christie@oracle.com/', 'source': 'secalert_us@oracle.com'}
  • () https://git.kernel.org/stable/c/54e57be2573cf0b8bf650375fd8752987b6c3d3b -
  • () https://git.kernel.org/stable/c/d8e6a27e9238dd294d6f2f401655f300dca20899 -

09 May 2025, 08:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/4226622647e3e5ac06d3ebc1605b917446157510 -

09 May 2025, 06:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/ccd3f449052449a917a3e577d8ba0368f43b8f29 -
Summary (en) In newer version of the SBC specs, we have a NDOB bit that indicates there is no data buffer that gets written out. If this bit is set using commands like "sg_write_same --ndob" we will crash in target_core_iblock/file's execute_write_same handlers when we go to access the se_cmd->t_data_sg because its NULL. CVSS 3.1 Base Score 7.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H). (en) In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix WRITE_SAME No Data Buffer crash In newer version of the SBC specs, we have a NDOB bit that indicates there is no data buffer that gets written out. If this bit is set using commands like "sg_write_same --ndob" we will crash in target_core_iblock/file's execute_write_same handlers when we go to access the se_cmd->t_data_sg because its NULL. This patch adds a check for the NDOB bit in the common WRITE SAME code because we don't support it. And, it adds a check for zero SG elements in each handler in case the initiator tries to send a normal WRITE SAME with no data buffer.

06 May 2025, 15:15

Type Values Removed Values Added
CWE CWE-476

05 May 2025, 20:54

Type Values Removed Values Added
Summary
  • (es) En versiones más recientes de las especificaciones de SBC, tenemos un bit NDOB que indica que no hay búfer de datos que se escriba. Si este bit se activa mediante comandos como "sg_write_same --ndob", se producirá un fallo en los controladores "execute_write_same" de target_core_iblock/file al acceder a se_cmd->t_data_sg, ya que es nulo. Puntuación base de CVSS 3.1: 7.7 (Afecta a la disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H).

02 May 2025, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-02 22:15

Updated : 2025-11-10 17:37

NVD link : CVE-2022-21546

Mitre link : CVE-2022-21546

CVE.ORG link : CVE-2022-21546

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference