CVE-2024-50153: scsi: target: core: Fix null-ptr-deref in target_alloc_device()
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: core: Fix null-ptr-deref in targetallocdevice()
There is a null-ptr-deref issue reported by KASAN:
BUG: KASAN: null-ptr-deref in targetallocdevice+0xbc4/0xbe0 [targetcoremod] ... kasanreport+0xb9/0xf0 targetallocdevice+0xbc4/0xbe0 [targetcoremod] coredevsetupvirtuallun0+0xef/0x1f0 [targetcoremod] targetcoreinitconfigfs+0x205/0x420 [targetcoremod] dooneinitcall+0xdd/0x4e0 ... entrySYSCALL64afterhwframe+0x76/0x7e
In targetallocdevice(), if allocing memory for dev queues fails, then dev will be freed by dev->transport->freedevice(), but dev->transport is not initialized at that time, which will lead to a null pointer reference problem.
Fixing this bug by freeing dev with hba->backend->ops->freedevice().
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.15.173.1-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.64.2-1 - Configuration
In target_alloc_device(), when allocation of memory for dev queues fails, free the partially-allocated dev using hba->backend->ops->free_device() (instead of dev->transport->free_device()), so the free operation does not dereference dev->transport before it is initialized. This fixes the KASAN null-ptr-deref reported at target_alloc_device+0xbc4/0xbe0 [target_core_mod].
Linux kernel scsi/target core (target_alloc_device) free_device() call = Use hba->backend->ops->free_device() when dev queue allocation fails
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50153?
CVE-2024-50153 has been classified as a medium-severity vulnerability due to its potential impact on system stability.
How do I fix CVE-2024-50153?
To address CVE-2024-50153, update your Linux kernel to a version that resolves the null pointer dereference issue.
Which Linux kernel versions are affected by CVE-2024-50153?
CVE-2024-50153 affects Linux kernel versions from 5.10.180 up to 6.12-rc3, among others within specific version ranges.
What type of issue is associated with CVE-2024-50153?
CVE-2024-50153 is associated with a null pointer dereference vulnerability in the Linux kernel.
Can CVE-2024-50153 be exploited remotely?
CVE-2024-50153 may lead to denial-of-service conditions, but its exploitability in a remote context depends on the system configuration.