7.8

CVE-2023-53322

scsi: qla2xxx: Wait for io return on terminate rport

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Wait for io return on terminate rport

System crash due to use after free.
Current code allows terminate_rport_io to exit before making
sure all IOs has returned. For FCP-2 device, IO's can hang
on in HW because driver has not tear down the session in FW at
first sign of cable pull. When dev_loss_tmo timer pops,
terminate_rport_io is called and upper layer is about to
free various resources. Terminate_rport_io trigger qla to do
the final cleanup, but the cleanup might not be fast enough where it
leave qla still holding on to the same resource.

Wait for IO's to return to upper layer before resources are freed.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version < 4.14.322
Linux ≫ Linux Kernel Version >= 4.15 < 4.19.291
Linux ≫ Linux Kernel Version >= 4.20 < 5.4.251
Linux ≫ Linux Kernel Version >= 5.5 < 5.10.188
Linux ≫ Linux Kernel Version >= 5.11 < 5.15.121
Linux ≫ Linux Kernel Version >= 5.16 < 6.1.40
Linux ≫ Linux Kernel Version >= 6.2 < 6.4.5
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.14% 0.037
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://git.kernel.org/stable/c/8a55556cd7e0220486163b1285ce11a8be2ce5fa
Patch
https://git.kernel.org/stable/c/4647d2e88918a078359d1532d90c417a38542c9e
Patch
https://git.kernel.org/stable/c/d25fded78d88e1515439b3ba581684d683e0b6ab
Patch
https://git.kernel.org/stable/c/a9fe97fb7b4ee21bffb76f2acb05769bad27ae70
Patch
https://git.kernel.org/stable/c/079c8264ed9fea8cbcac01ad29040f901cbc3692
Patch
https://git.kernel.org/stable/c/90770dad1eb30967ebd8d37d82830bcf270b3293
Patch
https://git.kernel.org/stable/c/5bcdaafd92be6035ddc77fa76650cf9dd5b864c4
Patch
https://git.kernel.org/stable/c/fc0cba0c7be8261a1625098bd1d695077ec621c9
Patch