In the Linux kernel, the following vulnerability has been resolved:
RDMA/srp: Do not call scsidone() from srpabort()
After scmdehaborthandler() has called the SCSI LLD ehaborthandler callback, it performs one of the following actions: * Call scsiqueueinsert(). * Call scsifinishcommand(). * Call scsiehscmdadd(). Hence, SCSI abort handlers must not call scsidone(). Otherwise all the above actions would trigger a use-after-free. Hence remove the scsidone() call from srpabort(). Keep the srpfree_req() call before returning SUCCESS because we may not see the command again if SUCCESS is returned.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/blob/ee626f5d79d5817bb21d6f048dc0da4c4e383443/cves/2023/52xxx/CVE-2023-52515.json"
}[
{
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2023-52515-0d3430ee",
"target": {
"function": "srp_abort",
"file": "drivers/infiniband/ulp/srp/ib_srp.c"
},
"digest": {
"function_hash": "72081909776043554880521855353937334118",
"length": 880.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@05a10b316adaac1f322007ca9a0383b410d759cc"
},
{
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2023-52515-143edc1b",
"target": {
"function": "srp_abort",
"file": "drivers/infiniband/ulp/srp/ib_srp.c"
},
"digest": {
"function_hash": "72081909776043554880521855353937334118",
"length": 880.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b9bdffb3f9aaeff8379c83f5449c6b42cb71c2b5"
},
{
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2023-52515-1ccf92da",
"target": {
"file": "drivers/infiniband/ulp/srp/ib_srp.c"
},
"digest": {
"line_hashes": [
"331710517509686525233953292203701883679",
"224260457475150942783056510909378017173",
"258989702908111619457438228276663035385",
"300738621926564067506200709155669286220",
"339852737311613350853314188939177939612",
"78149113622152418822030652731751456285",
"291383016351720761929123494180697252887",
"292602773256470889499736966774518904128",
"13443698327119699797525290957430858463",
"283476801486534379188069860385594916888",
"239013583871876966267047761481833518380",
"82784110756741217368398887515943287074",
"267768835603919286639954735906563028366",
"255694884089965605251406096717847172533",
"130001051404648924608113968540956737869",
"111693557143298108044429330994637867238",
"320158769476031538083210497967223929593",
"254662827071084615500374128586976713788",
"331691426579462128995638592888886223072"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@05a10b316adaac1f322007ca9a0383b410d759cc"
},
{
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2023-52515-34888b7e",
"target": {
"file": "drivers/infiniband/ulp/srp/ib_srp.c"
},
"digest": {
"line_hashes": [
"331710517509686525233953292203701883679",
"224260457475150942783056510909378017173",
"127782481100058922030630255782107589997",
"108615975872694488812463947755463234287",
"339852737311613350853314188939177939612",
"78149113622152418822030652731751456285",
"291383016351720761929123494180697252887",
"292602773256470889499736966774518904128",
"13443698327119699797525290957430858463",
"283476801486534379188069860385594916888",
"239013583871876966267047761481833518380",
"82784110756741217368398887515943287074",
"267768835603919286639954735906563028366",
"118054132471619649646519455757698713244",
"292889031964496789902945458632314992146",
"297773016346961279773991725570302253643",
"116437541126079883884436291028058979637",
"254662827071084615500374128586976713788",
"331691426579462128995638592888886223072"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@26788a5b48d9d5cd3283d777d238631c8cd7495a"
},
{
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2023-52515-4abcb2b2",
"target": {
"function": "srp_abort",
"file": "drivers/infiniband/ulp/srp/ib_srp.c"
},
"digest": {
"function_hash": "72081909776043554880521855353937334118",
"length": 880.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e193b7955dfad68035b983a0011f4ef3590c85eb"
},
{
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2023-52515-6849aad6",
"target": {
"file": "drivers/infiniband/ulp/srp/ib_srp.c"
},
"digest": {
"line_hashes": [
"331710517509686525233953292203701883679",
"224260457475150942783056510909378017173",
"258989702908111619457438228276663035385",
"300738621926564067506200709155669286220",
"339852737311613350853314188939177939612",
"78149113622152418822030652731751456285",
"291383016351720761929123494180697252887",
"292602773256470889499736966774518904128",
"13443698327119699797525290957430858463",
"283476801486534379188069860385594916888",
"239013583871876966267047761481833518380",
"82784110756741217368398887515943287074",
"267768835603919286639954735906563028366",
"255694884089965605251406096717847172533",
"130001051404648924608113968540956737869",
"111693557143298108044429330994637867238",
"320158769476031538083210497967223929593",
"254662827071084615500374128586976713788",
"331691426579462128995638592888886223072"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b9bdffb3f9aaeff8379c83f5449c6b42cb71c2b5"
},
{
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2023-52515-6f95acef",
"target": {
"function": "srp_abort",
"file": "drivers/infiniband/ulp/srp/ib_srp.c"
},
"digest": {
"function_hash": "134010521467679595794766500742195218431",
"length": 934.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@26788a5b48d9d5cd3283d777d238631c8cd7495a"
},
{
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2023-52515-89eabc20",
"target": {
"file": "drivers/infiniband/ulp/srp/ib_srp.c"
},
"digest": {
"line_hashes": [
"331710517509686525233953292203701883679",
"224260457475150942783056510909378017173",
"258989702908111619457438228276663035385",
"300738621926564067506200709155669286220",
"339852737311613350853314188939177939612",
"78149113622152418822030652731751456285",
"291383016351720761929123494180697252887",
"292602773256470889499736966774518904128",
"13443698327119699797525290957430858463",
"283476801486534379188069860385594916888",
"239013583871876966267047761481833518380",
"82784110756741217368398887515943287074",
"267768835603919286639954735906563028366",
"255694884089965605251406096717847172533",
"130001051404648924608113968540956737869",
"111693557143298108044429330994637867238",
"320158769476031538083210497967223929593",
"254662827071084615500374128586976713788",
"331691426579462128995638592888886223072"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e193b7955dfad68035b983a0011f4ef3590c85eb"
},
{
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2023-52515-bf18ab20",
"target": {
"file": "drivers/infiniband/ulp/srp/ib_srp.c"
},
"digest": {
"line_hashes": [
"331710517509686525233953292203701883679",
"224260457475150942783056510909378017173",
"258989702908111619457438228276663035385",
"300738621926564067506200709155669286220",
"339852737311613350853314188939177939612",
"78149113622152418822030652731751456285",
"291383016351720761929123494180697252887",
"292602773256470889499736966774518904128",
"13443698327119699797525290957430858463",
"283476801486534379188069860385594916888",
"239013583871876966267047761481833518380",
"82784110756741217368398887515943287074",
"267768835603919286639954735906563028366",
"255694884089965605251406096717847172533",
"130001051404648924608113968540956737869",
"111693557143298108044429330994637867238",
"320158769476031538083210497967223929593",
"254662827071084615500374128586976713788",
"331691426579462128995638592888886223072"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b298f9181582270d5e95774e5a6c7a7fb5b1206"
},
{
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2023-52515-c3774db3",
"target": {
"function": "srp_abort",
"file": "drivers/infiniband/ulp/srp/ib_srp.c"
},
"digest": {
"function_hash": "72081909776043554880521855353937334118",
"length": 880.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b298f9181582270d5e95774e5a6c7a7fb5b1206"
}
]