CVE-2021-47576

A flaw was found in the Linux kernel's SCSI debug (scsi_debug) driver. Due to missing validation of the block descriptor length in the resp_mode_select() function, a local user can trigger a use-after-free memory corruption flaw by submitting a crafted SCSI command. This vulnerability can lead to a denial of service (DoS) through a system crash or potentially allow privilege escalation.

This vulnerability is rated as having a Low impact for Red Hat products because the scsi_debug driver is intended strictly for debugging and software testing scenarios and is not loaded by default. Exploiting the flaw requires local access and the administrative loading of the simulated device driver. Consequently, typical production environments are not exposed in default configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.