CVE-2023-52785
published 2024-05-21CVE-2023-52785: In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR If command timeout…
PriorityP415medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EPSS
0.18%
7.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR
If command timeout happens and cq complete IRQ is raised at the same time,
ufshcd_mcq_abort clears lprb->cmd and a NULL pointer deref happens in the
ISR. Error log:
ufshcd_abort: Device abort task at tag 18
Unable to handle kernel NULL pointer dereference at virtual address
0000000000000108
pc : [0xffffffe27ef867ac] scsi_dma_unmap+0xc/0x44
lr : [0xffffffe27f1b898c] ufshcd_release_scsi_cmd+0x24/0x114
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.6.8-1 (forky) | linux 6.6.8-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= f1304d4420777f82a1d844c606db3d9eca841765 < 8f15a7e3c054d960bbd1521110700450bbf798a1 | 8f15a7e3c054d960bbd1521110700450bbf798a1 |
| linux | linux | >= f1304d4420777f82a1d844c606db3d9eca841765 < f84d461f33a6b27304d468d9cfb56c0cefdb4ee7 | f84d461f33a6b27304d468d9cfb56c0cefdb4ee7 |
| linux | linux | >= f1304d4420777f82a1d844c606db3d9eca841765 < 27900d7119c464b43cd9eac69c85884d17bae240 | 27900d7119c464b43cd9eac69c85884d17bae240 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.6.8-1 | 6.6.8-1 |
| linux | linux_kernel | >= 0 < 6.6.8-1 | 6.6.8-1 |
| linux | linux_kernel | >= 6.5 < 6.5.13 | 6.5.13 |
| linux | linux_kernel | >= 6.6 < 6.6.3 | 6.6.3 |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
osv4.7MEDIUM
vendor_debian4.7LOW
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR
vendor_redhat·2024-05-21·CVSS 4.7
CVE-2023-52785 [MEDIUM] CWE-413 kernel: scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR
kernel: scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR
If command timeout happens and cq complete IRQ is raised at the same time,
ufshcd_mcq_abort clears lprb->cmd and a NULL pointer deref happens in the
ISR. Error log:
ufshcd_abort: Device abort task at tag 18
Unable to handle kernel NULL pointer dereference at virtual address
0000000000000108
pc : [0xffffffe27ef867ac] scsi_dma_unmap+0xc/0x44
lr : [0xffffffe27f1b898c] ufshcd_release_scsi_cmd+0x24/0x114
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affec
Debian
CVE-2023-52785: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: ...
vendor_debian·2023·CVSS 4.7
CVE-2023-52785 [MEDIUM] CVE-2023-52785: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: ...
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR If command timeout happens and cq complete IRQ is raised at the same time, ufshcd_mcq_abort clears lprb->cmd and a NULL pointer deref happens in the ISR. Error log: ufshcd_abort: Device abort task at tag 18 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000108 pc : [0xffffffe27ef867ac] scsi_dma_unmap+0xc/0x44 lr : [0xffffffe27f1b898c] ufshcd_release_scsi_cmd+0x24/0x114
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 6.6.8-1)
sid: resolved (fixed in 6.6.8-1)
trixie: resolved (fixed in 6.6.8-1)
OSV
CVE-2023-52785: In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR If command ti
osv·2024-05-21·CVSS 4.7
CVE-2023-52785 [MEDIUM] CVE-2023-52785: In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR If command ti
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR If command timeout happens and cq complete IRQ is raised at the same time, ufshcd_mcq_abort clears lprb->cmd and a NULL pointer deref happens in the ISR. Error log: ufshcd_abort: Device abort task at tag 18 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000108 pc : [0xffffffe27ef867ac] scsi_dma_unmap+0xc/0x44 lr : [0xffffffe27f1b898c] ufshcd_release_scsi_cmd+0x24/0x114
GHSA
GHSA-7prj-h6r4-gh9j: In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR
If command
ghsa_unreviewed·2024-05-21
CVE-2023-52785 [MEDIUM] CWE-362 GHSA-7prj-h6r4-gh9j: In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR
If command
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR
If command timeout happens and cq complete IRQ is raised at the same time,
ufshcd_mcq_abort clears lprb->cmd and a NULL pointer deref happens in the
ISR. Error log:
ufshcd_abort: Device abort task at tag 18
Unable to handle kernel NULL pointer dereference at virtual address
0000000000000108
pc : [0xffffffe27ef867ac] scsi_dma_unmap+0xc/0x44
lr : [0xffffffe27f1b898c] ufshcd_release_scsi_cmd+0x24/0x114
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/27900d7119c464b43cd9eac69c85884d17bae240https://git.kernel.org/stable/c/8f15a7e3c054d960bbd1521110700450bbf798a1https://git.kernel.org/stable/c/f84d461f33a6b27304d468d9cfb56c0cefdb4ee7https://git.kernel.org/stable/c/27900d7119c464b43cd9eac69c85884d17bae240https://git.kernel.org/stable/c/8f15a7e3c054d960bbd1521110700450bbf798a1https://git.kernel.org/stable/c/f84d461f33a6b27304d468d9cfb56c0cefdb4ee7
2024-05-21
Published