CVE-2023-53586: In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix multiple LUN_RESET handling This fixes a bug where an initiator thinks a…

PriorityP419medium4.7CVSS 3.1

AVLACHPRLUINSUCNINAH

EPSS

0.42%

34.7th percentile

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix multiple LUN_RESET handling This fixes a bug where an initiator thinks a LUN_RESET has cleaned up running commands when it hasn't. The bug was added in commit 51ec502a3266 ("target: Delete tmr from list before processing"). The problem occurs when: 1. We have N I/O cmds running in the target layer spread over 2 sessions. 2. The initiator sends a LUN_RESET for each session. 3. session1's LUN_RESET loops over all the running commands from both sessions and moves them to its local drain_task_list. 4. session2's LUN_RESET does not see the LUN_RESET from session1 because the commit above has it remove itself. session2 also does not see any commands since the other reset moved them off the state lists. 5. sessions2's LUN_RESET will then complete with a successful response. 6. sessions2's inititor believes the running commands on its session are now cleaned up due to the successful response and cleans up the running commands from its side. It then restarts them. 7. The commands do eventually complete on the backend and the target starts to return aborted task statuses for them. The initiator will either throw a invalid ITT error or might accidentally lookup a new task if the ITT has been reallocated already. Fix the bug by reverting the patch, and serialize the execution of LUN_RESETs and Preempt and Aborts. Also prevent us from waiting on LUN_RESETs in core_tmr_drain_tmr_list, because it turns out the original patch fixed a bug that was not mentioned. For LUN_RESET1 core_tmr_drain_tmr_list can see a second LUN_RESET and wait on it. Then the second reset will run core_tmr_drain_tmr_list and see the first reset and wait on it resulting in a deadlock.

Affected

17 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.1.37-1 (bookworm)	linux 6.1.37-1 (bookworm)
linux	linux	—	—
linux	linux	>= 51ec502a32665fed66c7f03799ede4023b212536 < e1f59cd18a10969d08a082264b557876ca38766e	e1f59cd18a10969d08a082264b557876ca38766e
linux	linux	>= 51ec502a32665fed66c7f03799ede4023b212536 < 9158c86fd3237acaea8f0181c7836d90fd6eea10	9158c86fd3237acaea8f0181c7836d90fd6eea10
linux	linux	>= 51ec502a32665fed66c7f03799ede4023b212536 < eacfe32c3650bfd0e54224d160c431013d7f6998	eacfe32c3650bfd0e54224d160c431013d7f6998
linux	linux	>= 51ec502a32665fed66c7f03799ede4023b212536 < ed18526289b5603bf2253dee50f1d7ec245cf397	ed18526289b5603bf2253dee50f1d7ec245cf397
linux	linux	>= 51ec502a32665fed66c7f03799ede4023b212536 < 2c43de56f9220dca3e28c774d1c5e2cab574223a	2c43de56f9220dca3e28c774d1c5e2cab574223a
linux	linux	>= 51ec502a32665fed66c7f03799ede4023b212536 < 673db054d7a2b5a470d7a25baf65956d005ad729	673db054d7a2b5a470d7a25baf65956d005ad729
linux	linux_kernel	>= 0 < 5.10.191-1	5.10.191-1
linux	linux_kernel	>= 0 < 6.1.37-1	6.1.37-1
linux	linux_kernel	>= 0 < 6.3.7-1	6.3.7-1
linux	linux_kernel	>= 0 < 6.3.7-1	6.3.7-1
linux	linux_kernel	>= 4.11 < 5.10.180	5.10.180
linux	linux_kernel	>= 5.11 < 5.15.111	5.15.111
linux	linux_kernel	>= 5.16 < 6.1.28	6.1.28
linux	linux_kernel	>= 6.2 < 6.2.15	6.2.15
linux	linux_kernel	>= 6.3 < 6.3.2	6.3.2

CVSS provenance

nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

osv4.7MEDIUM

vendor_debian4.7MEDIUM

vendor_redhat4.7MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.