Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2023-52515

RDMA/srp: Do not call scsi_done() from srp_abort()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: Do not call scsi_done() from srp_abort() After scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler callback, it performs one of the following actions: * Call scsi_queue_insert(). * Call scsi_finish_command(). * Call scsi_eh_scmd_add(). Hence, SCSI abort handlers must not call scsi_done(). Otherwise all the above actions would trigger a use-after-free. Hence remove the scsi_done() call from srp_abort(). Keep the srp_free_req() call before returning SUCCESS because we may not see the command again if SUCCESS is returned.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • d8536670916a685df116b5c2cb256573fd25e4e3 to < 26788a5b48d9d5cd3283d777d238631c8cd7495aaffected
  • d8536670916a685df116b5c2cb256573fd25e4e3 to < b9bdffb3f9aaeff8379c83f5449c6b42cb71c2b5affected
  • d8536670916a685df116b5c2cb256573fd25e4e3 to < 2b298f9181582270d5e95774e5a6c7a7fb5b1206affected
  • d8536670916a685df116b5c2cb256573fd25e4e3 to < 05a10b316adaac1f322007ca9a0383b410d759ccaffected
  • d8536670916a685df116b5c2cb256573fd25e4e3 to < e193b7955dfad68035b983a0011f4ef3590c85ebaffected
  • 738589592a04180e39b6fb5fe8205d85b7dc69f6affected
  • 0575df129e2eb4a801beae0e6e041787480f42b9affected
  • 22fb582405002812d8fb89d0ed1264e97d3d25adaffected
  • 39d6594c457c4728794cb4c3c7be53f93f1ef3aeaffected
  • b3f3b814add77a464911df0080d812b18f61ff38affected
  • 3.0.45 to < 3.1affected
  • 3.2.32 to < 3.3affected
  • 3.4.13 to < 3.5affected
  • 3.5.6 to < 3.6affected
  • 3.6.1 to < 3.7affected

Linux Linux

Default version status: affected

  • 3.7affected
  • 0 to < 3.7unaffected
  • 5.10.199 to ≤ 5.10.*unaffected
  • 5.15.136 to ≤ 5.15.*unaffected
  • 6.1.57 to ≤ 6.1.*unaffected
  • 6.5.7 to ≤ 6.5.*unaffected
  • 6.6 to ≤ *unaffected

References