CVE-2023-53387: scsi: ufs: core: Fix device management cmd timeout flow
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: core: Fix device management cmd timeout flow
In the UFS error handling flow, the host will send a device management cmd (NOP OUT) to the device for link recovery. If this cmd times out and clearing the doorbell fails, ufshcdwaitfordevcmd() will do nothing and return. hba->devcmd.complete struct is not set to NULL.
When this happens, if cmd has been completed by device, then we will call complete() in ufshcdtransferreqcompl(). Because the complete struct is allocated on the stack, the following crash will occur:
ipanicdie+0x24/0x38 [mrdump] die+0x344/0x748 arm64notifydie+0x44/0x104 dodebugexception+0x104/0x1e0 el1dbg+0x38/0x54 el1synchandler+0x40/0x88 el1sync+0x8c/0x140 queuedspinlockslowpath+0x2e4/0x3c0 ufshcdtransferreqcompl+0x3b0/0x1164 ufshcdtrchandler+0x15c/0x308 ufshcdhostresetandrestore+0x54/0x260 ufshcdresetandrestore+0x28c/0x57c ufshcderrhandler+0xeb8/0x1b6c processonework+0x288/0x964 workerthread+0x4bc/0xc7c kthread+0x15c/0x264 retfromfork+0x10/0x30
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-53387?
The severity of CVE-2023-53387 is classified as moderate.
How do I fix CVE-2023-53387?
To fix CVE-2023-53387, upgrade your Linux kernel to the latest version where this vulnerability has been resolved.
What systems are affected by CVE-2023-53387?
CVE-2023-53387 affects various versions of the Linux kernel that utilize the UFS driver.
Can CVE-2023-53387 be exploited remotely?
CVE-2023-53387 is primarily a local vulnerability as it requires access to the affected system to exploit.
What is the impact of CVE-2023-53387 on system stability?
CVE-2023-53387 can lead to device management command timeouts, which may affect the reliability of link recovery.