CVE-2023-52515

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-52515
In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: Do not call scsi_done() from srp_abort() After scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler callback, it performs one of the following actions: * Call scsi_queue_insert(). * Call scsi_finish_command(). * Call scsi_eh_scmd_add(). Hence, SCSI abort handlers must not call scsi_done(). Otherwise all the above actions would trigger a use-after-free. Hence remove the scsi_done() call from srp_abort(). Keep the srp_free_req() call before returning SUCCESS because we may not see the command again if SUCCESS is returned.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/05a10b316adaac1f322007ca9a0383b410d759cc Patch
https://git.kernel.org/stable/c/26788a5b48d9d5cd3283d777d238631c8cd7495a Patch
https://git.kernel.org/stable/c/2b298f9181582270d5e95774e5a6c7a7fb5b1206 Patch
https://git.kernel.org/stable/c/b9bdffb3f9aaeff8379c83f5449c6b42cb71c2b5 Patch
https://git.kernel.org/stable/c/e193b7955dfad68035b983a0011f4ef3590c85eb Patch
https://git.kernel.org/stable/c/05a10b316adaac1f322007ca9a0383b410d759cc Patch
https://git.kernel.org/stable/c/26788a5b48d9d5cd3283d777d238631c8cd7495a Patch
https://git.kernel.org/stable/c/2b298f9181582270d5e95774e5a6c7a7fb5b1206 Patch
https://git.kernel.org/stable/c/b9bdffb3f9aaeff8379c83f5449c6b42cb71c2b5 Patch
https://git.kernel.org/stable/c/e193b7955dfad68035b983a0011f4ef3590c85eb Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.6:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.6:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.6:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.6:rc4:*:*:*:*:*:*
History

11 Dec 2024, 16:41

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/05a10b316adaac1f322007ca9a0383b410d759cc - () https://git.kernel.org/stable/c/05a10b316adaac1f322007ca9a0383b410d759cc - Patch
References () https://git.kernel.org/stable/c/26788a5b48d9d5cd3283d777d238631c8cd7495a - () https://git.kernel.org/stable/c/26788a5b48d9d5cd3283d777d238631c8cd7495a - Patch
References () https://git.kernel.org/stable/c/2b298f9181582270d5e95774e5a6c7a7fb5b1206 - () https://git.kernel.org/stable/c/2b298f9181582270d5e95774e5a6c7a7fb5b1206 - Patch
References () https://git.kernel.org/stable/c/b9bdffb3f9aaeff8379c83f5449c6b42cb71c2b5 - () https://git.kernel.org/stable/c/b9bdffb3f9aaeff8379c83f5449c6b42cb71c2b5 - Patch
References () https://git.kernel.org/stable/c/e193b7955dfad68035b983a0011f4ef3590c85eb - () https://git.kernel.org/stable/c/e193b7955dfad68035b983a0011f4ef3590c85eb - Patch
CPE cpe:2.3:o:linux:linux_kernel:6.6:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.6:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.6:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.6:rc1:*:*:*:*:*:*
CWE CWE-416
First Time Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8

21 Nov 2024, 08:39

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: RDMA/srp: No llamar a scsi_done() desde srp_abort() Después de que scmd_eh_abort_handler() haya llamado a la devolución de llamada SCSI LLD eh_abort_handler, realiza una de las siguientes acciones: * Llamar a scsi_queue_insert( ). * Llame a scsi_finish_command(). * Llame a scsi_eh_scmd_add(). Por lo tanto, los controladores de abortos SCSI no deben llamar a scsi_done(). De lo contrario, todas las acciones anteriores desencadenarían un Use After Free. Por lo tanto, elimine la llamada scsi_done() de srp_abort(). Mantenga la llamada srp_free_req() antes de devolver SUCCESS porque es posible que no veamos el comando nuevamente si se devuelve SUCCESS.
References () https://git.kernel.org/stable/c/05a10b316adaac1f322007ca9a0383b410d759cc - () https://git.kernel.org/stable/c/05a10b316adaac1f322007ca9a0383b410d759cc -
References () https://git.kernel.org/stable/c/26788a5b48d9d5cd3283d777d238631c8cd7495a - () https://git.kernel.org/stable/c/26788a5b48d9d5cd3283d777d238631c8cd7495a -
References () https://git.kernel.org/stable/c/2b298f9181582270d5e95774e5a6c7a7fb5b1206 - () https://git.kernel.org/stable/c/2b298f9181582270d5e95774e5a6c7a7fb5b1206 -
References () https://git.kernel.org/stable/c/b9bdffb3f9aaeff8379c83f5449c6b42cb71c2b5 - () https://git.kernel.org/stable/c/b9bdffb3f9aaeff8379c83f5449c6b42cb71c2b5 -
References () https://git.kernel.org/stable/c/e193b7955dfad68035b983a0011f4ef3590c85eb - () https://git.kernel.org/stable/c/e193b7955dfad68035b983a0011f4ef3590c85eb -

02 Mar 2024, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-02 22:15

Updated : 2024-12-11 16:41

NVD link : CVE-2023-52515

Mitre link : CVE-2023-52515

CVE.ORG link : CVE-2023-52515

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free