CVE-2023-53174: scsi: core: Fix possible memory leak if device_add() fails
In the Linux kernel, the following vulnerability has been resolved:
scsi: core: Fix possible memory leak if deviceadd() fails
If deviceadd() returns error, the name allocated by devsetname() needs be freed. As the comment of deviceadd() says, putdevice() should be used to decrease the reference count in the error path. So fix this by calling putdevice(), then the name can be freed in kobjectcleanp().
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-53174?
CVE-2023-53174 has a medium severity due to the potential for memory leaks if the device_add() function fails.
Which versions of the Linux Kernel are affected by CVE-2023-53174?
CVE-2023-53174 affects various versions of the Linux Kernel prior to the fix being applied.
How do I fix CVE-2023-53174?
To fix CVE-2023-53174, update to the latest version of the Linux Kernel that contains the patch for this vulnerability.
What is the impact of CVE-2023-53174?
The impact of CVE-2023-53174 includes a potential memory leak that could lead to resource exhaustion on the affected system.
Is CVE-2023-53174 specific to any particular Linux distribution?
CVE-2023-53174 is not limited to a specific Linux distribution, as it is a vulnerability in the Linux kernel itself.