CVE-2023-53643

While the error recovery work is temporarily failing reconnect attempts, running the 'nvme list' command causes a kernel NULL pointer dereference by calling getsockname() with a released socket.

During error recovery work, the nvme tcp socket is released and a new one created, so it is not safe to access the socket without proper check.

Database specific

{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53643.json"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

02c57a82c0081141abc19150beab48ef47f97f18

Fixed

fe2d9e54165dadaa0d0cc3355c0be9c3e129fa0d

Fixed

d82f762db4776fa11de88018f0f5de2d5db72a72

Fixed

76d54bf20cdcc1ed7569a89885e09636e9a8d71d

Affected versions

v6.*

v6.0

v6.0-rc3

v6.0-rc4

v6.0-rc5

v6.0-rc6

v6.0-rc7

v6.1

v6.1-rc1

v6.1-rc2

v6.1-rc3

v6.1-rc4

v6.1-rc5

v6.1-rc6

v6.1-rc7

v6.1-rc8

v6.1.1

v6.1.10

v6.1.11

v6.1.12

v6.1.13

v6.1.14

v6.1.15

v6.1.16

v6.1.17

v6.1.2

v6.1.3

v6.1.4

v6.1.5

v6.1.6

v6.1.7

v6.1.8

v6.1.9

v6.2

v6.2-rc1

v6.2-rc2

v6.2-rc3

v6.2-rc4

v6.2-rc5

v6.2-rc6

v6.2-rc7

v6.2-rc8

v6.2.1

v6.2.2

v6.2.3

v6.2.4

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53643.json"

vanir_signatures

[
    {
        "id": "CVE-2023-53643-09336877",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe2d9e54165dadaa0d0cc3355c0be9c3e129fa0d",
        "target": {
            "file": "drivers/nvme/host/tcp.c"
        },
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "310216401841086643682702878966568467258",
                "129283572921468133065732060440888582025",
                "166313223915934619679882704047379246601",
                "194036503599464021629164569699542406357",
                "208948253552281324493803843886585669009",
                "155278035506714970559446626167567764803",
                "136379386825869073416672326844570382672"
            ],
            "threshold": 0.9
        }
    },
    {
        "id": "CVE-2023-53643-14a4fec1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d82f762db4776fa11de88018f0f5de2d5db72a72",
        "target": {
            "file": "drivers/nvme/host/tcp.c"
        },
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "310216401841086643682702878966568467258",
                "129283572921468133065732060440888582025",
                "166313223915934619679882704047379246601",
                "194036503599464021629164569699542406357",
                "208948253552281324493803843886585669009",
                "155278035506714970559446626167567764803",
                "136379386825869073416672326844570382672"
            ],
            "threshold": 0.9
        }
    },
    {
        "id": "CVE-2023-53643-82acfc76",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76d54bf20cdcc1ed7569a89885e09636e9a8d71d",
        "target": {
            "file": "drivers/nvme/host/tcp.c"
        },
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "310216401841086643682702878966568467258",
                "129283572921468133065732060440888582025",
                "166313223915934619679882704047379246601",
                "194036503599464021629164569699542406357",
                "208948253552281324493803843886585669009",
                "155278035506714970559446626167567764803",
                "136379386825869073416672326844570382672"
            ],
            "threshold": 0.9
        }
    },
    {
        "id": "CVE-2023-53643-9f00a105",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76d54bf20cdcc1ed7569a89885e09636e9a8d71d",
        "target": {
            "file": "drivers/nvme/host/tcp.c",
            "function": "nvme_tcp_get_address"
        },
        "signature_type": "Function",
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 408.0,
            "function_hash": "284154743915645594072361028443368282829"
        }
    },
    {
        "id": "CVE-2023-53643-a007f43a",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe2d9e54165dadaa0d0cc3355c0be9c3e129fa0d",
        "target": {
            "file": "drivers/nvme/host/tcp.c",
            "function": "nvme_tcp_get_address"
        },
        "signature_type": "Function",
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 408.0,
            "function_hash": "284154743915645594072361028443368282829"
        }
    },
    {
        "id": "CVE-2023-53643-d2f4dd8e",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d82f762db4776fa11de88018f0f5de2d5db72a72",
        "target": {
            "file": "drivers/nvme/host/tcp.c",
            "function": "nvme_tcp_get_address"
        },
        "signature_type": "Function",
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 408.0,
            "function_hash": "284154743915645594072361028443368282829"
        }
    }
]

Git / github.com/gregkh/linux