In the Linux kernel, the following vulnerability has been resolved:
scsi: qla4xxx: Add length check when parsing nlattrs
There are three places that qla4xxx parses nlattrs:
qla4xxxsetchap_entry()
qla4xxxifaceset_param()
qla4xxxsysfsddbsetparam()
and each of them directly converts the nlattr to specific pointer of structure without length checking. This could be dangerous as those attributes are not validated and a malformed nlattr (e.g., length 0) could result in an OOB read that leaks heap dirty data.
Add the nla_len check before accessing the nlattr data and return EINVAL if the length check fails.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53456.json",
"cna_assigner": "Linux"
}"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53456.json"
[
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c"
},
"digest": {
"line_hashes": [
"268363812237935287487601178379968562124",
"202342171917639544770016707679543411897",
"20775047463208341311940215575425655051",
"248919291957800566503451950147722768610",
"333108223054550065109294851201155409660",
"75397008217556031383041936020171218926",
"307630662496362302354025972749635697328",
"200330657609417865505842522839439472815",
"235701479077232664955302374568235983064",
"32470346438944667263002850588253730831",
"189500923495230325938352078514802592491",
"118181951935690122182938726272310514558"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-53456-084ffcbd",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47cd3770e31df942e2bb925a9a855c79ed0662eb",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c",
"function": "qla4xxx_set_chap_entry"
},
"digest": {
"length": 2141.0,
"function_hash": "211241028574299459268454024765880196884"
},
"signature_type": "Function",
"id": "CVE-2023-53456-24c0d404",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cfa6a1a79ed6d336fac7a5d87eb5471e4401829f",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c"
},
"digest": {
"line_hashes": [
"268363812237935287487601178379968562124",
"202342171917639544770016707679543411897",
"20775047463208341311940215575425655051",
"248919291957800566503451950147722768610",
"333108223054550065109294851201155409660",
"75397008217556031383041936020171218926",
"307630662496362302354025972749635697328",
"200330657609417865505842522839439472815",
"235701479077232664955302374568235983064",
"32470346438944667263002850588253730831",
"189500923495230325938352078514802592491",
"118181951935690122182938726272310514558"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-53456-2ee25165",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d65079c69dc1feb817ed71f5bd15e83a7d6832d",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c"
},
"digest": {
"line_hashes": [
"268363812237935287487601178379968562124",
"202342171917639544770016707679543411897",
"20775047463208341311940215575425655051",
"248919291957800566503451950147722768610",
"333108223054550065109294851201155409660",
"75397008217556031383041936020171218926",
"307630662496362302354025972749635697328",
"200330657609417865505842522839439472815",
"235701479077232664955302374568235983064",
"32470346438944667263002850588253730831",
"189500923495230325938352078514802592491",
"118181951935690122182938726272310514558"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-53456-319edc36",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25feffb3fbd51ae81d92c65cebc0e932663828b3",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c",
"function": "qla4xxx_set_chap_entry"
},
"digest": {
"length": 2141.0,
"function_hash": "211241028574299459268454024765880196884"
},
"signature_type": "Function",
"id": "CVE-2023-53456-34d94b97",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5925e224cc6edfef57b20447f18323208461309b",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c",
"function": "qla4xxx_set_chap_entry"
},
"digest": {
"length": 2141.0,
"function_hash": "211241028574299459268454024765880196884"
},
"signature_type": "Function",
"id": "CVE-2023-53456-4c80cb2f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47f3be62eab50b8cd7e1ae5fc2c4dae687497c34",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c",
"function": "qla4xxx_sysfs_ddb_set_param"
},
"digest": {
"length": 5873.0,
"function_hash": "212584760553697969729552856850537021103"
},
"signature_type": "Function",
"id": "CVE-2023-53456-56b84a0a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cfa6a1a79ed6d336fac7a5d87eb5471e4401829f",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c"
},
"digest": {
"line_hashes": [
"268363812237935287487601178379968562124",
"202342171917639544770016707679543411897",
"20775047463208341311940215575425655051",
"248919291957800566503451950147722768610",
"333108223054550065109294851201155409660",
"75397008217556031383041936020171218926",
"307630662496362302354025972749635697328",
"200330657609417865505842522839439472815",
"235701479077232664955302374568235983064",
"32470346438944667263002850588253730831",
"189500923495230325938352078514802592491",
"118181951935690122182938726272310514558"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-53456-67bbe958",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47f3be62eab50b8cd7e1ae5fc2c4dae687497c34",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c",
"function": "qla4xxx_iface_set_param"
},
"digest": {
"length": 2423.0,
"function_hash": "204317978903899348130102920164023177851"
},
"signature_type": "Function",
"id": "CVE-2023-53456-6e752705",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47f3be62eab50b8cd7e1ae5fc2c4dae687497c34",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c"
},
"digest": {
"line_hashes": [
"268363812237935287487601178379968562124",
"202342171917639544770016707679543411897",
"20775047463208341311940215575425655051",
"248919291957800566503451950147722768610",
"333108223054550065109294851201155409660",
"75397008217556031383041936020171218926",
"307630662496362302354025972749635697328",
"200330657609417865505842522839439472815",
"235701479077232664955302374568235983064",
"32470346438944667263002850588253730831",
"189500923495230325938352078514802592491",
"118181951935690122182938726272310514558"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-53456-716889e5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5925e224cc6edfef57b20447f18323208461309b",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c",
"function": "qla4xxx_iface_set_param"
},
"digest": {
"length": 2423.0,
"function_hash": "204317978903899348130102920164023177851"
},
"signature_type": "Function",
"id": "CVE-2023-53456-744286d6",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ed21975311247bb84e82298eeb359ec0a0fa84d",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c",
"function": "qla4xxx_sysfs_ddb_set_param"
},
"digest": {
"length": 5873.0,
"function_hash": "212584760553697969729552856850537021103"
},
"signature_type": "Function",
"id": "CVE-2023-53456-7ee00eac",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d65079c69dc1feb817ed71f5bd15e83a7d6832d",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c",
"function": "qla4xxx_set_chap_entry"
},
"digest": {
"length": 2139.0,
"function_hash": "269261916548959822319531814485976064884"
},
"signature_type": "Function",
"id": "CVE-2023-53456-7f8123e3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f61fc650c47849637fa1771a31a11674c824138a",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c"
},
"digest": {
"line_hashes": [
"268363812237935287487601178379968562124",
"202342171917639544770016707679543411897",
"20775047463208341311940215575425655051",
"248919291957800566503451950147722768610",
"333108223054550065109294851201155409660",
"75397008217556031383041936020171218926",
"307630662496362302354025972749635697328",
"200330657609417865505842522839439472815",
"235701479077232664955302374568235983064",
"32470346438944667263002850588253730831",
"189500923495230325938352078514802592491",
"118181951935690122182938726272310514558"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-53456-80bca7e3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ed21975311247bb84e82298eeb359ec0a0fa84d",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c",
"function": "qla4xxx_sysfs_ddb_set_param"
},
"digest": {
"length": 5873.0,
"function_hash": "212584760553697969729552856850537021103"
},
"signature_type": "Function",
"id": "CVE-2023-53456-81704fbc",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5925e224cc6edfef57b20447f18323208461309b",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c",
"function": "qla4xxx_set_chap_entry"
},
"digest": {
"length": 2139.0,
"function_hash": "269261916548959822319531814485976064884"
},
"signature_type": "Function",
"id": "CVE-2023-53456-845cd3fb",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d65079c69dc1feb817ed71f5bd15e83a7d6832d",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c",
"function": "qla4xxx_set_chap_entry"
},
"digest": {
"length": 2139.0,
"function_hash": "269261916548959822319531814485976064884"
},
"signature_type": "Function",
"id": "CVE-2023-53456-8d4fece0",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25feffb3fbd51ae81d92c65cebc0e932663828b3",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c",
"function": "qla4xxx_sysfs_ddb_set_param"
},
"digest": {
"length": 5873.0,
"function_hash": "212584760553697969729552856850537021103"
},
"signature_type": "Function",
"id": "CVE-2023-53456-95e83afc",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b018c0440b871d8b001c996e95fa4538bd292de6",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c",
"function": "qla4xxx_iface_set_param"
},
"digest": {
"length": 2423.0,
"function_hash": "204317978903899348130102920164023177851"
},
"signature_type": "Function",
"id": "CVE-2023-53456-9b850e5f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25feffb3fbd51ae81d92c65cebc0e932663828b3",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c",
"function": "qla4xxx_sysfs_ddb_set_param"
},
"digest": {
"length": 5873.0,
"function_hash": "212584760553697969729552856850537021103"
},
"signature_type": "Function",
"id": "CVE-2023-53456-9e857bd4",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47f3be62eab50b8cd7e1ae5fc2c4dae687497c34",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c",
"function": "qla4xxx_sysfs_ddb_set_param"
},
"digest": {
"length": 5873.0,
"function_hash": "212584760553697969729552856850537021103"
},
"signature_type": "Function",
"id": "CVE-2023-53456-a88366aa",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25feffb3fbd51ae81d92c65cebc0e932663828b3",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c"
},
"digest": {
"line_hashes": [
"268363812237935287487601178379968562124",
"202342171917639544770016707679543411897",
"20775047463208341311940215575425655051",
"248919291957800566503451950147722768610",
"333108223054550065109294851201155409660",
"75397008217556031383041936020171218926",
"307630662496362302354025972749635697328",
"200330657609417865505842522839439472815",
"235701479077232664955302374568235983064",
"32470346438944667263002850588253730831",
"189500923495230325938352078514802592491",
"118181951935690122182938726272310514558"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-53456-ab4ed244",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b018c0440b871d8b001c996e95fa4538bd292de6",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c",
"function": "qla4xxx_iface_set_param"
},
"digest": {
"length": 2423.0,
"function_hash": "204317978903899348130102920164023177851"
},
"signature_type": "Function",
"id": "CVE-2023-53456-aeda98ea",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5925e224cc6edfef57b20447f18323208461309b",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c",
"function": "qla4xxx_iface_set_param"
},
"digest": {
"length": 2423.0,
"function_hash": "204317978903899348130102920164023177851"
},
"signature_type": "Function",
"id": "CVE-2023-53456-b656fa55",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f61fc650c47849637fa1771a31a11674c824138a",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c",
"function": "qla4xxx_sysfs_ddb_set_param"
},
"digest": {
"length": 5873.0,
"function_hash": "212584760553697969729552856850537021103"
},
"signature_type": "Function",
"id": "CVE-2023-53456-b83a4976",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ed21975311247bb84e82298eeb359ec0a0fa84d",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c",
"function": "qla4xxx_set_chap_entry"
},
"digest": {
"length": 2139.0,
"function_hash": "269261916548959822319531814485976064884"
},
"signature_type": "Function",
"id": "CVE-2023-53456-cb8e5c32",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47cd3770e31df942e2bb925a9a855c79ed0662eb",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c",
"function": "qla4xxx_sysfs_ddb_set_param"
},
"digest": {
"length": 5873.0,
"function_hash": "212584760553697969729552856850537021103"
},
"signature_type": "Function",
"id": "CVE-2023-53456-cdfd384c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f61fc650c47849637fa1771a31a11674c824138a",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c"
},
"digest": {
"line_hashes": [
"268363812237935287487601178379968562124",
"202342171917639544770016707679543411897",
"20775047463208341311940215575425655051",
"248919291957800566503451950147722768610",
"333108223054550065109294851201155409660",
"75397008217556031383041936020171218926",
"307630662496362302354025972749635697328",
"200330657609417865505842522839439472815",
"235701479077232664955302374568235983064",
"32470346438944667263002850588253730831",
"189500923495230325938352078514802592491",
"118181951935690122182938726272310514558"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-53456-dc597886",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f61fc650c47849637fa1771a31a11674c824138a",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c"
},
"digest": {
"line_hashes": [
"268363812237935287487601178379968562124",
"202342171917639544770016707679543411897",
"20775047463208341311940215575425655051",
"248919291957800566503451950147722768610",
"333108223054550065109294851201155409660",
"75397008217556031383041936020171218926",
"307630662496362302354025972749635697328",
"200330657609417865505842522839439472815",
"235701479077232664955302374568235983064",
"32470346438944667263002850588253730831",
"189500923495230325938352078514802592491",
"118181951935690122182938726272310514558"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-53456-de15bc82",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cfa6a1a79ed6d336fac7a5d87eb5471e4401829f",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c",
"function": "qla4xxx_sysfs_ddb_set_param"
},
"digest": {
"length": 5873.0,
"function_hash": "212584760553697969729552856850537021103"
},
"signature_type": "Function",
"id": "CVE-2023-53456-de5a663d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47cd3770e31df942e2bb925a9a855c79ed0662eb",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c",
"function": "qla4xxx_set_chap_entry"
},
"digest": {
"length": 2139.0,
"function_hash": "269261916548959822319531814485976064884"
},
"signature_type": "Function",
"id": "CVE-2023-53456-debfd8e4",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ed21975311247bb84e82298eeb359ec0a0fa84d",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c",
"function": "qla4xxx_iface_set_param"
},
"digest": {
"length": 2423.0,
"function_hash": "204317978903899348130102920164023177851"
},
"signature_type": "Function",
"id": "CVE-2023-53456-e3a09cbc",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b018c0440b871d8b001c996e95fa4538bd292de6",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c",
"function": "qla4xxx_iface_set_param"
},
"digest": {
"length": 2423.0,
"function_hash": "204317978903899348130102920164023177851"
},
"signature_type": "Function",
"id": "CVE-2023-53456-ed5052a2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d65079c69dc1feb817ed71f5bd15e83a7d6832d",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c",
"function": "qla4xxx_set_chap_entry"
},
"digest": {
"length": 2139.0,
"function_hash": "269261916548959822319531814485976064884"
},
"signature_type": "Function",
"id": "CVE-2023-53456-ed68a532",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b018c0440b871d8b001c996e95fa4538bd292de6",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c",
"function": "qla4xxx_iface_set_param"
},
"digest": {
"length": 2465.0,
"function_hash": "231253067519383952686690903864430219864"
},
"signature_type": "Function",
"id": "CVE-2023-53456-f75fe1b8",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cfa6a1a79ed6d336fac7a5d87eb5471e4401829f",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c",
"function": "qla4xxx_iface_set_param"
},
"digest": {
"length": 2423.0,
"function_hash": "204317978903899348130102920164023177851"
},
"signature_type": "Function",
"id": "CVE-2023-53456-fd305d0b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47cd3770e31df942e2bb925a9a855c79ed0662eb",
"deprecated": false,
"signature_version": "v1"
}
]