Google: sys-kernel/lakitu-kernel-6_1: security update to 17872.0.0

medium Tenable Cloud Security Plugin ID 450559

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Fix handling of virtual
Fibre Channel timeouts Hyper-V provides the ability to connect Fibre Channel LUNs to the host system and
present them in a guest VM as a SCSI device. I/O to the vFC device is handled by the storvsc driver. The
storvsc driver includes a partial integration with the FC transport implemented in the generic portion of
the Linux SCSI subsystem so that FC attributes can be displayed in /sys. However, the partial integration
means that some aspects of vFC don't work properly. Unfortunately, a full and correct integration isn't
practical because of limitations in what Hyper-V provides to the guest. In particular, in the context of
Hyper-V storvsc, the FC transport timeout function fc_eh_timed_out() causes a kernel panic because it
can't find the rport and dereferences a NULL pointer. The original patch that added the call from
storvsc_eh_timed_out() to fc_eh_timed_out() is faulty in this regard. In many cases a timeout is due to a
transient condition, so the situation can be improved by just continuing to wait like with other I/O
requests issued by storvsc, and avoiding the guaranteed panic. For a permanent failure, continuing to wait
may result in a hung thread instead of a panic, which again may be better. So fix the panic by removing
the storvsc call to fc_eh_timed_out(). This allows storvsc to keep waiting for a response. The change has
been tested by users who experienced a panic in fc_eh_timed_out() due to transient timeouts, and it solves
their problem. In the future we may want to deprecate the vFC functionality in storvsc since it can't be
fully fixed. But it has current users for whom it is working well enough, so it should probably stay for a
while longer. (CVE-2023-53245)

Solution

Update the sys-kernel/lakitu-kernel-6_1 library and its related packages to version 17872.0.0 or later.

Plugin Details

Severity: Medium

ID: 450559

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/1/2026

Updated: 10/1/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2023-53245

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 7/21/2021

Reference Information

CVE: CVE-2023-53245

Detections

Analytics