CVE-2024-36025

What it actually does

Off-by-one error in qla_edif_app_getstats() uses > instead of >= when indexing into an array sized to app_req.num_ports, allowing one past-the-end write and kernel memory corruption.

Why it matters to the business

Kernel memory corruption on systems using QLogic Fibre Channel HBAs can cause crashes, data corruption, or potential privilege escalation, disrupting storage operations and requiring urgent patching across Linux fleets.

How an attack unfolds

An attacker with local access or the ability to influence the app_req.num_ports value triggers qla_edif_app_getstats() so that the loop writes one element beyond the allocated app_reply->elem[] buffer, corrupting adjacent kernel memory.

How to fix it

Update the Linux kernel to a version containing commit 8c820f7c8e9b46238d277c575392fe9930207aab or later; rebuild and deploy the patched qla2xxx module; prioritize systems with QLogic adapters.

How to confirm the fix worked

Confirm the running kernel contains commit 8c820f7c8e9b46238d277c575392fe9930207aab; inspect the qla_edif_app_getstats() source to verify the comparison changed to >=; test with valid and boundary num_ports values.

Typical attack path

1. Obtain local execution or a context that can call into the qla2xxx EDIF stats path
2. Craft or influence input so app_req.num_ports matches the allocated size exactly
3. Invoke the vulnerable function to perform the off-by-one write
4. Leverage the resulting memory corruption for denial of service or further exploitation

How to detect it

Review kernel logs for oops or panic messages mentioning qla_edif_app_getstats or qla2xxx; look for unexpected memory corruption indicators in dmesg after calls to EDIF stats functions.

What your security team should do

• Apply the upstream fix or distribution kernel update containing 8c820f7c8e9b immediately on all systems exposing QLogic HBAs
• Inventory hosts using the qla2xxx driver and schedule reboots
• Monitor for kernel oops or crashes referencing qla_edif_app_getstats after patching