CVE-2023-54179

A flaw was found in the Linux kernel qla2xxx SCSI driver. A static analysis tool reported that the array vha->host_str, sized to hold 16 characters, could be indexed with values outside its valid range, potentially leading to out-of-bounds writes. The root cause was the use of sprintf() without enforcing proper bounds checks. An unprivileged local user with access to trigger the affected driver logic may be able to cause a kernel crash or hang, resulting in a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.