CVE-2023-52515: RDMA/srp: Do not call scsi_done() from srp_abort()
In the Linux kernel, the following vulnerability has been resolved:
RDMA/srp: Do not call scsidone() from srpabort()
After scmdehaborthandler() has called the SCSI LLD ehaborthandler callback, it performs one of the following actions: Call scsiqueueinsert(). Call scsifinishcommand(). Call scsiehscmdadd(). Hence, SCSI abort handlers must not call scsidone(). Otherwise all the above actions would trigger a use-after-free. Hence remove the scsidone() call from srpabort(). Keep the srpfreereq() call before returning SUCCESS because we may not see the command again if SUCCESS is returned.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Do not call scsi_done() from srp_abort(); ensure the abort handler sequence does not invoke scsi_done() to avoid use-after-free.
Linux kernel SCSI RDMA/srp scsi_done() invocation from srp_abort() = must not call - Configuration
Keep the srp_free_req() call in the srp abort path; removing it can lead to incorrect command handling.
Linux kernel RDMA/srp srp_free_req() call = keep
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52515?
CVE-2023-52515 has a moderate severity rating as it impacts the Linux kernel's RDMA subsystem.
How do I fix CVE-2023-52515?
To fix CVE-2023-52515, update your Linux kernel to a version that includes the fix for this vulnerability.
Which Linux kernel versions are affected by CVE-2023-52515?
CVE-2023-52515 affects Linux kernel versions between 3.7 and 6.5.7, including various release candidates.
Is CVE-2023-52515 exploitative in nature?
There is currently no public evidence suggesting CVE-2023-52515 is actively being exploited in the wild.
What specific component is impacted by CVE-2023-52515?
CVE-2023-52515 impacts the SRP (SCSI RDMA Protocol) handling in the Linux kernel.