CVE-2024-43821

A flaw was found in the Linux kernel. A local attacker with elevated privileges could exploit a null pointer dereference vulnerability within the scsi: lpfc component. This occurs when memory allocation fails in the lpfc_xcvr_data_show function, causing a critical pointer to become null. Subsequent operations attempt to use this null pointer, which can lead to a system crash and result in a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, prevent the lpfc kernel module from loading if Fibre Channel storage is not in use. This can be achieved by blacklisting the module.

1. Create /etc/modprobe.d/blacklist-lpfc.conf with blacklist lpfc.
2. Regenerate the initramfs: dracut -f -v (RHEL 7) or dracut -f --regenerate-all (RHEL 8/9).
3. Reboot the system.

This action will disable Fibre Channel functionality that relies on the lpfc driver.