CVE-2023-52515
published 2024-03-02CVE-2023-52515: In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: Do not call scsi_done() from srp_abort() After scmd_eh_abort_handler() has called…
PriorityP337high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.23%
14.0th percentile
In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: Do not call scsi_done() from srp_abort() After scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler callback, it performs one of the following actions: * Call scsi_queue_insert(). * Call scsi_finish_command(). * Call scsi_eh_scmd_add(). Hence, SCSI abort handlers must not call scsi_done(). Otherwise all the above actions would trigger a use-after-free. Hence remove the scsi_done() call from srp_abort(). Keep the srp_free_req() call before returning SUCCESS because we may not see the command again if SUCCESS is returned.
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.64-1 (bookworm) | linux 6.1.64-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 3.0.45 < 3.1 | 3.1 |
| linux | linux | >= 3.2.32 < 3.3 | 3.3 |
| linux | linux | >= 3.4.13 < 3.5 | 3.5 |
| linux | linux | >= 3.5.6 < 3.6 | 3.6 |
| linux | linux | >= 3.6.1 < 3.7 | 3.7 |
| linux | linux | >= d8536670916a685df116b5c2cb256573fd25e4e3 < 26788a5b48d9d5cd3283d777d238631c8cd7495a | 26788a5b48d9d5cd3283d777d238631c8cd7495a |
| linux | linux | >= d8536670916a685df116b5c2cb256573fd25e4e3 < b9bdffb3f9aaeff8379c83f5449c6b42cb71c2b5 | b9bdffb3f9aaeff8379c83f5449c6b42cb71c2b5 |
| linux | linux | >= d8536670916a685df116b5c2cb256573fd25e4e3 < 2b298f9181582270d5e95774e5a6c7a7fb5b1206 | 2b298f9181582270d5e95774e5a6c7a7fb5b1206 |
| linux | linux | >= d8536670916a685df116b5c2cb256573fd25e4e3 < 05a10b316adaac1f322007ca9a0383b410d759cc | 05a10b316adaac1f322007ca9a0383b410d759cc |
| linux | linux | >= d8536670916a685df116b5c2cb256573fd25e4e3 < e193b7955dfad68035b983a0011f4ef3590c85eb | e193b7955dfad68035b983a0011f4ef3590c85eb |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.205-1 | 5.10.205-1 |
| linux | linux_kernel | >= 0 < 6.1.64-1 | 6.1.64-1 |
| linux | linux_kernel | >= 0 < 6.5.8-1 | 6.5.8-1 |
| linux | linux_kernel | >= 0 < 6.5.8-1 | 6.5.8-1 |
| linux | linux_kernel | >= 3.7 < 5.10.199 | 5.10.199 |
| linux | linux_kernel | >= 5.11 < 5.15.136 | 5.15.136 |
| linux | linux_kernel | >= 5.16 < 6.1.57 | 6.1.57 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: RDMA/srp: Do not call scsi_done() from srp_abort()
vendor_redhat·2024-03-02·CVSS 7.8
CVE-2023-52515 [HIGH] CWE-416 kernel: RDMA/srp: Do not call scsi_done() from srp_abort()
kernel: RDMA/srp: Do not call scsi_done() from srp_abort()
In the Linux kernel, the following vulnerability has been resolved:
RDMA/srp: Do not call scsi_done() from srp_abort()
After scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler
callback, it performs one of the following actions:
* Call scsi_queue_insert().
* Call scsi_finish_command().
* Call scsi_eh_scmd_add().
Hence, SCSI abort handlers must not call scsi_done(). Otherwise all
the above actions would trigger a use-after-free. Hence remove the
scsi_done() call from srp_abort(). Keep the srp_free_req() call
before returning SUCCESS because we may not see the command again if
SUCCESS is returned.
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
P
Debian
CVE-2023-52515: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: D...
vendor_debian·2023·CVSS 7.8
CVE-2023-52515 [HIGH] CVE-2023-52515: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: D...
In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: Do not call scsi_done() from srp_abort() After scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler callback, it performs one of the following actions: * Call scsi_queue_insert(). * Call scsi_finish_command(). * Call scsi_eh_scmd_add(). Hence, SCSI abort handlers must not call scsi_done(). Otherwise all the above actions would trigger a use-after-free. Hence remove the scsi_done() call from srp_abort(). Keep the srp_free_req() call before returning SUCCESS because we may not see the command again if SUCCESS is returned.
Scope: local
bookworm: resolved (fixed in 6.1.64-1)
bullseye: resolved (fixed in 5.10.205-1)
forky: resolved (fixed in 6.5.8-1)
sid: resolved (fixed in 6.5.8-1)
trixie: resolved (fixed
GHSA
GHSA-9mhh-v2w9-x3xj: In the Linux kernel, the following vulnerability has been resolved:
RDMA/srp: Do not call scsi_done() from srp_abort()
After scmd_eh_abort_handler()
ghsa_unreviewed·2024-03-03
CVE-2023-52515 [HIGH] CWE-416 GHSA-9mhh-v2w9-x3xj: In the Linux kernel, the following vulnerability has been resolved:
RDMA/srp: Do not call scsi_done() from srp_abort()
After scmd_eh_abort_handler()
In the Linux kernel, the following vulnerability has been resolved:
RDMA/srp: Do not call scsi_done() from srp_abort()
After scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler
callback, it performs one of the following actions:
* Call scsi_queue_insert().
* Call scsi_finish_command().
* Call scsi_eh_scmd_add().
Hence, SCSI abort handlers must not call scsi_done(). Otherwise all
the above actions would trigger a use-after-free. Hence remove the
scsi_done() call from srp_abort(). Keep the srp_free_req() call
before returning SUCCESS because we may not see the command again if
SUCCESS is returned.
OSV
CVE-2023-52515: In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: Do not call scsi_done() from srp_abort() After scmd_eh_abort_handler() h
osv·2024-03-02·CVSS 7.8
CVE-2023-52515 [HIGH] CVE-2023-52515: In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: Do not call scsi_done() from srp_abort() After scmd_eh_abort_handler() h
In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: Do not call scsi_done() from srp_abort() After scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler callback, it performs one of the following actions: * Call scsi_queue_insert(). * Call scsi_finish_command(). * Call scsi_eh_scmd_add(). Hence, SCSI abort handlers must not call scsi_done(). Otherwise all the above actions would trigger a use-after-free. Hence remove the scsi_done() call from srp_abort(). Keep the srp_free_req() call before returning SUCCESS because we may not see the command again if SUCCESS is returned.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/05a10b316adaac1f322007ca9a0383b410d759cchttps://git.kernel.org/stable/c/26788a5b48d9d5cd3283d777d238631c8cd7495ahttps://git.kernel.org/stable/c/2b298f9181582270d5e95774e5a6c7a7fb5b1206https://git.kernel.org/stable/c/b9bdffb3f9aaeff8379c83f5449c6b42cb71c2b5https://git.kernel.org/stable/c/e193b7955dfad68035b983a0011f4ef3590c85ebhttps://git.kernel.org/stable/c/05a10b316adaac1f322007ca9a0383b410d759cchttps://git.kernel.org/stable/c/26788a5b48d9d5cd3283d777d238631c8cd7495ahttps://git.kernel.org/stable/c/2b298f9181582270d5e95774e5a6c7a7fb5b1206https://git.kernel.org/stable/c/b9bdffb3f9aaeff8379c83f5449c6b42cb71c2b5https://git.kernel.org/stable/c/e193b7955dfad68035b983a0011f4ef3590c85eb
2024-03-02
Published