CVE-2023-54184 — Expired Pointer Dereference in Linux

CWE-825 — Expired Pointer Dereference7 documents6 sources
Severity
5.5MEDIUM
No vector
EPSS
0.0%
top 89.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
LinuxLinux KernelDebian Linux
Timeline
PublishedDec 30

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsit: Free cmds before session free Commands from recovery entries are freed after session has been closed. That leads to use-after-free at command free or NPE with such call trace: Time2Retain timer expired for SID: 1, cleaning up iSCSI session. BUG: kernel NULL pointer dereference, address: 0000000000000140 RIP: 0010:sbitmap_queue_clear+0x3a/0xa0 Call Trace: target_release_cmd_kref+0xd1/0x1f0 [target_core_mo…

Affected Packages4 packages

▶Linuxlinux/linux_kernel3.12.0 — 5.4.244+4
▶Debianlinux/linux_kernel< 5.10.191-1+3
▶CVEListV5linux/linux988e3a85463d9b6dabc681df3f8f131b23c19953 — 89f5055f9b0b57c7e7f02e32df95ef401f809b71+6
▶debiandebian/linux< linux 6.1.37-1 (bookworm)

🔴Vulnerability Details

3
OSV
scsi: target: iscsit: Free cmds before session free↗2025-12-30
▶
OSV
CVE-2023-54184: In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsit: Free cmds before session free Commands from recovery entries↗2025-12-30
▶
GHSA
GHSA-mhc4-7fcr-wrj3: In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsit: Free cmds before session free Commands from recovery entri↗2025-12-30
▶

📋Vendor Advisories

2
Red Hat
kernel: scsi: target: iscsit: Free cmds before session free↗2025-12-30
▶
Debian
CVE-2023-54184: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: targe...↗2023
▶

🕵️Threat Intelligence

1
Wiz
CVE-2023-54184 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶