CVE-2023-53320: scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info()
In the Linux kernel, the following vulnerability has been resolved:
scsi: mpi3mr: Fix issues in mpi3mrgetalltgtinfo()
The function mpi3mrgetalltgtinfo() has four issues:
1) It calculates valid entry length in alltgtinfo assuming the header part of the struct mpi3mrdevicemapinfo would equal to sizeof(u32). The correct size is sizeof(u64).
2) When it calculates the valid entry length kernentrylen, it excludes one entry by subtracting 1 from numdevices.
3) It copies numdevice by calling memcpy(). Substitution is enough.
4) It does not specify the calculated length to sgcopyfrombuffer(). Instead, it specifies the payload length which is larger than the alltgtinfo size. It causes "BUG: KASAN: slab-out-of-bounds".
Fix the issues by using the correct header size, removing the subtraction from numdevices, replacing the memcpy() with substitution and specifying the correct length to sgcopyfrombuffer().
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-53320?
CVE-2023-53320 is rated as a high-severity vulnerability due to its potential impact on system stability and security.
How do I fix CVE-2023-53320?
To fix CVE-2023-53320, update the Linux kernel to the latest stable version that includes the resolution for this vulnerability.
What software is affected by CVE-2023-53320?
CVE-2023-53320 affects the Linux Kernel, specifically relating to the 'scsi: mpi3mr' subsystem.
What are the implications of CVE-2023-53320?
The implications of CVE-2023-53320 include potential data corruption and unauthorized access to device information.
Is CVE-2023-53320 being actively exploited?
As of now, there is no public report indicating that CVE-2023-53320 is being actively exploited in the wild.