Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2023-54184

scsi: target: iscsit: Free cmds before session free

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsit: Free cmds before session free Commands from recovery entries are freed after session has been closed. That leads to use-after-free at command free or NPE with such call trace: Time2Retain timer expired for SID: 1, cleaning up iSCSI session. BUG: kernel NULL pointer dereference, address: 0000000000000140 RIP: 0010:sbitmap_queue_clear+0x3a/0xa0 Call Trace: target_release_cmd_kref+0xd1/0x1f0 [target_core_mod] transport_generic_free_cmd+0xd1/0x180 [target_core_mod] iscsit_free_cmd+0x53/0xd0 [iscsi_target_mod] iscsit_free_connection_recovery_entries+0x29d/0x320 [iscsi_target_mod] iscsit_close_session+0x13a/0x140 [iscsi_target_mod] iscsit_check_post_dataout+0x440/0x440 [iscsi_target_mod] call_timer_fn+0x24/0x140 Move cleanup of recovery enrties to before session freeing.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 988e3a85463d9b6dabc681df3f8f131b23c19953 to < 89f5055f9b0b57c7e7f02e32df95ef401f809b71affected
  • 988e3a85463d9b6dabc681df3f8f131b23c19953 to < 4621e24c9257c6379343bf0c11b473817cf7edcdaffected
  • 988e3a85463d9b6dabc681df3f8f131b23c19953 to < 1911cca5916b6e106de7afa3ec0a38447158216caffected
  • 988e3a85463d9b6dabc681df3f8f131b23c19953 to < a7a4def6c7046e090bb10c6d550fdeb487db98baaffected
  • 988e3a85463d9b6dabc681df3f8f131b23c19953 to < 4ce221d295f53e6c6b835ab33181e735482c9aacaffected
  • 988e3a85463d9b6dabc681df3f8f131b23c19953 to < d8990b5a4d065f38f35d69bcd627ec5a7f8330caaffected

Linux Linux

Default version status: affected

  • 3.12affected
  • 0 to < 3.12unaffected
  • 5.4.244 to ≤ 5.4.*unaffected
  • 5.10.181 to ≤ 5.10.*unaffected
  • 5.15.113 to ≤ 5.15.*unaffected
  • 6.1.30 to ≤ 6.1.*unaffected
  • 6.3.4 to ≤ 6.3.*unaffected
  • 6.4 to ≤ *unaffected

References