In the Linux kernel, the following vulnerability has been resolved:
nvmet: avoid potential UAF in nvmetreqcomplete()
An nvme target ->queueresponse() operation implementation may free the request passed as argument. Such implementation potentially could result in a use after free of the request pointer when percpurefput() is called in nvmetreq_complete().
Avoid such problem by using a local variable to save the sq pointer before calling _nvmetreq_complete(), thus avoiding dereferencing the req pointer after that function call.
{ "vanir_signatures": [ { "id": "CVE-2023-53116-09498fb8", "signature_type": "Function", "digest": { "function_hash": "39205024126308812362063342910353193640", "length": 115.0 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ed9813871038b25a934b21ab76b5b7dbf44fc3a", "target": { "file": "drivers/nvme/target/core.c", "function": "nvmet_req_complete" }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53116-0c2dfdaf", "signature_type": "Function", "digest": { "function_hash": "39205024126308812362063342910353193640", "length": 115.0 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@04c394208831d5e0d5cfee46722eb0f033cd4083", "target": { "file": "drivers/nvme/target/core.c", "function": "nvmet_req_complete" }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53116-1eee9b2d", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "108857256040769022167598215945824766085", "238181946144775628550008917407708488041", "333197109882205849918236154448452129442", "309373350101311567512550581557924931607", "190559498276353321393539295703932041343", "54898981316773466310283277483259865857" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f1d5888a5efe345b63c430b256e95acb0a475642", "target": { "file": "drivers/nvme/target/core.c" }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53116-345370fb", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "108857256040769022167598215945824766085", "238181946144775628550008917407708488041", "333197109882205849918236154448452129442", "309373350101311567512550581557924931607", "190559498276353321393539295703932041343", "54898981316773466310283277483259865857" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fafcb4b26393870c45462f9af6a48e581dbbcf7e", "target": { "file": "drivers/nvme/target/core.c" }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53116-3877f11e", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "244213728531309343392355203245398743684", "238181946144775628550008917407708488041", "333197109882205849918236154448452129442", "309373350101311567512550581557924931607", "190559498276353321393539295703932041343", "54898981316773466310283277483259865857" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5d99b29012bbf0e86929403209723b2806500c1", "target": { "file": "drivers/nvme/target/core.c" }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53116-40918ea5", "signature_type": "Function", "digest": { "function_hash": "39205024126308812362063342910353193640", "length": 115.0 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fafcb4b26393870c45462f9af6a48e581dbbcf7e", "target": { "file": "drivers/nvme/target/core.c", "function": "nvmet_req_complete" }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53116-52772083", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "108857256040769022167598215945824766085", "238181946144775628550008917407708488041", "333197109882205849918236154448452129442", "309373350101311567512550581557924931607", "190559498276353321393539295703932041343", "54898981316773466310283277483259865857" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ed9813871038b25a934b21ab76b5b7dbf44fc3a", "target": { "file": "drivers/nvme/target/core.c" }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53116-6166131c", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "108857256040769022167598215945824766085", "238181946144775628550008917407708488041", "333197109882205849918236154448452129442", "309373350101311567512550581557924931607", "190559498276353321393539295703932041343", "54898981316773466310283277483259865857" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6317235da8aa7cb97529ebc8121cc2a4c4c437a", "target": { "file": "drivers/nvme/target/core.c" }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53116-899a42ff", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "108857256040769022167598215945824766085", "238181946144775628550008917407708488041", "333197109882205849918236154448452129442", "309373350101311567512550581557924931607", "190559498276353321393539295703932041343", "54898981316773466310283277483259865857" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6173a77b7e9d3e202bdb9897b23f2a8afe7bf286", "target": { "file": "drivers/nvme/target/core.c" }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53116-99379fee", "signature_type": "Function", "digest": { "function_hash": "39205024126308812362063342910353193640", "length": 115.0 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f1d5888a5efe345b63c430b256e95acb0a475642", "target": { "file": "drivers/nvme/target/core.c", "function": "nvmet_req_complete" }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53116-ab18f8b7", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "108857256040769022167598215945824766085", "238181946144775628550008917407708488041", "333197109882205849918236154448452129442", "309373350101311567512550581557924931607", "190559498276353321393539295703932041343", "54898981316773466310283277483259865857" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@04c394208831d5e0d5cfee46722eb0f033cd4083", "target": { "file": "drivers/nvme/target/core.c" }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53116-b6a9f29e", "signature_type": "Function", "digest": { "function_hash": "39205024126308812362063342910353193640", "length": 115.0 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6317235da8aa7cb97529ebc8121cc2a4c4c437a", "target": { "file": "drivers/nvme/target/core.c", "function": "nvmet_req_complete" }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53116-c054082d", "signature_type": "Function", "digest": { "function_hash": "39205024126308812362063342910353193640", "length": 115.0 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5d99b29012bbf0e86929403209723b2806500c1", "target": { "file": "drivers/nvme/target/core.c", "function": "nvmet_req_complete" }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53116-e6d8cc97", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "108857256040769022167598215945824766085", "238181946144775628550008917407708488041", "333197109882205849918236154448452129442", "309373350101311567512550581557924931607", "190559498276353321393539295703932041343", "54898981316773466310283277483259865857" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bcd535f07c58342302a2cd2bdd8894fe0872c8a9", "target": { "file": "drivers/nvme/target/core.c" }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53116-f1f1e6d4", "signature_type": "Function", "digest": { "function_hash": "39205024126308812362063342910353193640", "length": 115.0 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6173a77b7e9d3e202bdb9897b23f2a8afe7bf286", "target": { "file": "drivers/nvme/target/core.c", "function": "nvmet_req_complete" }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-53116-f54fc849", "signature_type": "Function", "digest": { "function_hash": "39205024126308812362063342910353193640", "length": 115.0 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bcd535f07c58342302a2cd2bdd8894fe0872c8a9", "target": { "file": "drivers/nvme/target/core.c", "function": "nvmet_req_complete" }, "deprecated": false, "signature_version": "v1" } ] }