5.5

CVE-2023-53464

scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param()

In the Linux kernel, the following vulnerability has been resolved:

scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param()

The validity of sock should be checked before assignment to avoid incorrect
values. Commit 57569c37f0ad ("scsi: iscsi: iscsi_tcp: Fix null-ptr-deref
while calling getpeername()") introduced this change which may lead to
inconsistent values of tcp_sw_conn->sendpage and conn->datadgst_en.

Fix the issue by moving the position of the assignment.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 5.10.150 < 5.10.178
Linux ≫ Linux Kernel Version >= 5.15.75 < 5.15.107
Linux ≫ Linux Kernel Version >= 5.19.17 < 6.0
Linux ≫ Linux Kernel Version >= 6.0.3 < 6.1.24
Linux ≫ Linux Kernel Version >= 6.2 < 6.2.11
Linux ≫ Linux Kernel Version6.3 Updaterc1
Linux ≫ Linux Kernel Version6.3 Updaterc2
Linux ≫ Linux Kernel Version6.3 Updaterc3
Linux ≫ Linux Kernel Version6.3 Updaterc4
Linux ≫ Linux Kernel Version6.3 Updaterc5
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.15% 0.047
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

https://git.kernel.org/stable/c/48b19b79cfa37b1e50da3b5a8af529f994c08901
Patch
https://git.kernel.org/stable/c/499757ad3332e2527254f9ab68dec1da087b1d96
Patch
https://git.kernel.org/stable/c/5e5c5f472972c4bc9430adc08b36763a0fa5b9f7
Patch
https://git.kernel.org/stable/c/6e06a68fbbfcd8576eee8f7139fa2b13c9b72e91
Patch
https://git.kernel.org/stable/c/b287e21e73ec23f3788fbe40037c42dbe6e9a9a9
Patch