CVE-2024-50183

What it actually does

Race condition in the lpfc driver allows NPIV instance deletion before DA_ID handling completes, resulting in kref imbalance and potential resource management failures.

Why it matters to the business

May cause kernel instability or crashes on systems using Emulex Fibre Channel adapters with NPIV, disrupting storage connectivity and operations on older Ubuntu 14.04 LTS kernels.

How an attack unfolds

An attacker with local access or control over NPIV management triggers concurrent deletion and DA_ID operations to exploit the race, leading to imbalance conditions that could enable denial of service or further kernel-level attacks.

How to fix it

Upgrade affected packages to fixed versions including linux 3.13.0-66.108, linux-lts-utopic 3.16.0-51.69~14.04.1, linux-lts-vivid 3.19.0-31.36~14.04.1, or linux-lts-wily 4.2.0-18.22~14.04.1.

How to confirm the fix worked

Confirm kernel package versions match the listed fixed releases and perform functional testing of NPIV create/delete operations under load.

Typical attack path

1. Gain access to a system running the vulnerable lpfc driver with NPIV configured
2. Initiate NPIV instance deletion concurrently with ongoing DA_ID fabric operations
3. Trigger the kref imbalance race to induce instability or crash

How to detect it

Review kernel logs for oops or panic entries involving lpfc during NPIV deletion and check for signs of incomplete fabric ndlp release.

What your security team should do

• Prioritize kernel updates on all systems using lpfc with NPIV
• Audit storage configurations to identify unnecessary NPIV usage
• Monitor kernel logs for lpfc-related panics during fabric operations