CVE-2009-3556

Vulnerability

The qla2xxx driver on Red Hat Enterprise Linux 5, when using N_Port ID Virtualization (NPIV) hardware, exposes two sysfs pseudo-files, vport_create and vport_delete, under /sys/class/scsi_host/. A Red Hat configuration step set these files world-writable, allowing any local user to write to them. This affects systems with the qla2xxx driver and NPIV-capable hardware. The issue was introduced in RHBA-2008:0314 [4].

Exploitation

An attacker with local access to the system can write to the vport_create or vport_delete files. No special privileges are required beyond being able to write to world-writable files. By writing appropriate values, the attacker can create or delete virtual ports (vports) on the SCSI host, thereby altering the SCSI host attributes.

Impact

Successful exploitation allows a local user to make arbitrary changes to SCSI host attributes, specifically by creating or deleting virtual ports. This could lead to unauthorized management of NPIV virtual ports, potentially causing denial of service or enabling further attacks on the storage network. The impact is limited to systems using the qla2xxx driver with NPIV hardware.

Mitigation

Red Hat released kernel updates as part of RHSA-2010-0046 [1] to fix this issue by correcting the permissions on these sysfs files. Users should apply the updated kernel packages. The vulnerability only affects Red Hat Enterprise Linux 5; other distributions are not affected [4]. No workaround is mentioned; updating is the recommended action.