CVE-2024-43816

A flaw was found in the Linux kernel. Specifically, within the lpfc SCSI driver, an issue exists in the lpfc_prep_embed_io routine. On big-endian architectures, incorrect handling of data endianness during a memory copy operation can lead to an out-of-bounds pointer dereference. This vulnerability can be triggered when Fibre Channel Protocol (FCP) targets are zoned, potentially causing the system to crash and resulting in a Denial of Service (DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the lpfc kernel module from loading if Fibre Channel functionality provided by Emulex LightPulse Fibre Channel adapters is not required on big-endian systems.

1. Create /etc/modprobe.d/blacklist-lpfc.conf with blacklist lpfc.
2. Regenerate the initramfs using dracut -f -v or mkinitrd -f -v /boot/initramfs-$(uname -r).img $(uname -r).
3. A system reboot is required for the changes to take effect. This action will disable Fibre Channel functionality provided by the lpfc driver.