CVE-2023-52975

EUVD-2023-59745

27.03.2025, 17:15

In the Linux kernel, the following vulnerability has been resolved:

scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress

Bug report and analysis from Ding Hui.

During iSCSI session logout, if another task accesses the shost ipaddress
attr, we can get a KASAN UAF report like this:

[  276.942144] BUG: KASAN: use-after-free in _raw_spin_lock_bh+0x78/0xe0
[  276.942535] Write of size 4 at addr ffff8881053b45b8 by task cat/4088
[  276.943511] CPU: 2 PID: 4088 Comm: cat Tainted: G            E      6.1.0-rc8+ #3
[  276.943997] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020
[  276.944470] Call Trace:
[  276.944943]  <TASK>
[  276.945397]  dump_stack_lvl+0x34/0x48
[  276.945887]  print_address_description.constprop.0+0x86/0x1e7
[  276.946421]  print_report+0x36/0x4f
[  276.947358]  kasan_report+0xad/0x130
[  276.948234]  kasan_check_range+0x35/0x1c0
[  276.948674]  _raw_spin_lock_bh+0x78/0xe0
[  276.949989]  iscsi_sw_tcp_host_get_param+0xad/0x2e0 [iscsi_tcp]
[  276.951765]  show_host_param_ISCSI_HOST_PARAM_IPADDRESS+0xe9/0x130 [scsi_transport_iscsi]
[  276.952185]  dev_attr_show+0x3f/0x80
[  276.953005]  sysfs_kf_seq_show+0x1fb/0x3e0
[  276.953401]  seq_read_iter+0x402/0x1020
[  276.954260]  vfs_read+0x532/0x7b0
[  276.955113]  ksys_read+0xed/0x1c0
[  276.955952]  do_syscall_64+0x38/0x90
[  276.956347]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[  276.956769] RIP: 0033:0x7f5d3a679222
[  276.957161] Code: c0 e9 b2 fe ff ff 50 48 8d 3d 32 c0 0b 00 e8 a5 fe 01 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24
[  276.958009] RSP: 002b:00007ffc864d16a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[  276.958431] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f5d3a679222
[  276.958857] RDX: 0000000000020000 RSI: 00007f5d3a4fe000 RDI: 0000000000000003
[  276.959281] RBP: 00007f5d3a4fe000 R08: 00000000ffffffff R09: 0000000000000000
[  276.959682] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000020000
[  276.960126] R13: 0000000000000003 R14: 0000000000000000 R15: 0000557a26dada58
[  276.960536]  </TASK>
[  276.961357] Allocated by task 2209:
[  276.961756]  kasan_save_stack+0x1e/0x40
[  276.962170]  kasan_set_track+0x21/0x30
[  276.962557]  __kasan_kmalloc+0x7e/0x90
[  276.962923]  __kmalloc+0x5b/0x140
[  276.963308]  iscsi_alloc_session+0x28/0x840 [scsi_transport_iscsi]
[  276.963712]  iscsi_session_setup+0xda/0xba0 [libiscsi]
[  276.964078]  iscsi_sw_tcp_session_create+0x1fd/0x330 [iscsi_tcp]
[  276.964431]  iscsi_if_create_session.isra.0+0x50/0x260 [scsi_transport_iscsi]
[  276.964793]  iscsi_if_recv_msg+0xc5a/0x2660 [scsi_transport_iscsi]
[  276.965153]  iscsi_if_rx+0x198/0x4b0 [scsi_transport_iscsi]
[  276.965546]  netlink_unicast+0x4d5/0x7b0
[  276.965905]  netlink_sendmsg+0x78d/0xc30
[  276.966236]  sock_sendmsg+0xe5/0x120
[  276.966576]  ____sys_sendmsg+0x5fe/0x860
[  276.966923]  ___sys_sendmsg+0xe0/0x170
[  276.967300]  __sys_sendmsg+0xc8/0x170
[  276.967666]  do_syscall_64+0x38/0x90
[  276.968028]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[  276.968773] Freed by task 2209:
[  276.969111]  kasan_save_stack+0x1e/0x40
[  276.969449]  kasan_set_track+0x21/0x30
[  276.969789]  kasan_save_free_info+0x2a/0x50
[  276.970146]  __kasan_slab_free+0x106/0x190
[  276.970470]  __kmem_cache_free+0x133/0x270
[  276.970816]  device_release+0x98/0x210
[  276.971145]  kobject_cleanup+0x101/0x360
[  276.971462]  iscsi_session_teardown+0x3fb/0x530 [libiscsi]
[  276.971775]  iscsi_sw_tcp_session_destroy+0xd8/0x130 [iscsi_tcp]
[  276.972143]  iscsi_if_recv_msg+0x1bf1/0x2660 [scsi_transport_iscsi]
[  276.972485]  iscsi_if_rx+0x198/0x4b0 [scsi_transport_iscsi]
[  276.972808]  netlink_unicast+0x4d5/0x7b0
[  276.973201]  netlink_sendmsg+0x78d/0xc30
[  276.973544]  sock_sendmsg+0xe5/0x120
[  276.973864]  ____sys_sendmsg+0x5fe/0x860
[  276.974248]  ___sys_
---truncated---

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.8 HIGH	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 5%

Affected Products (NVD)

Vendor	Product	Version
linux	linux_kernel	𝑥 < 5.10.248
linux	linux_kernel	5.11 ≤ 𝑥 < 5.15.93
linux	linux_kernel	5.16 ≤ 𝑥 < 6.1.11
linux	linux_kernel	6.2:rc1
linux	linux_kernel	6.2:rc2
linux	linux_kernel	6.2:rc3
linux	linux_kernel	6.2:rc4
linux	linux_kernel	6.2:rc5

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

linux

bookworm	6.1.129-1 fixed
bookworm (security)	6.1.128-1 fixed
bullseye	vulnerable
bullseye (security)	vulnerable
sid	6.12.20-1 fixed
trixie	6.12.19-1 fixed

openSUSE / SLES Releases

openSUSE Product

Release

cluster-md-kmp-default

suse enterprise server 12 SP5	4.12.14-122.261.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.100.1 fixed

dlm-kmp-default

suse enterprise server 12 SP5	4.12.14-122.261.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.100.1 fixed

gfs2-kmp-default

suse enterprise server 12 SP5	4.12.14-122.261.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.100.1 fixed

kernel-64kb

suse enterprise server 15 SP4	5.14.21-150400.24.161.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.100.1 fixed

kernel-default

suse enterprise server 12 SP5	4.12.14-122.261.1 fixed
suse enterprise server 15 SP4	5.14.21-150400.24.161.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.100.1 fixed

kernel-default-base

suse enterprise server 12 SP5	4.12.14-122.261.1 fixed
suse enterprise server 15 SP4	5.14.21-150400.24.161.1.150400.24.80.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.100.1.150500.6.47.1 fixed

kernel-default-man

suse enterprise server 12 SP5

4.12.14-122.261.1

fixed

kernel-docs

suse enterprise server 15 SP4	5.14.21-150400.24.161.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.100.1 fixed

kernel-macros

suse enterprise server 12 SP5	4.12.14-122.261.1 fixed
suse enterprise server 15 SP4	5.14.21-150400.24.161.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.100.1 fixed

kernel-obs-build

suse enterprise server 15 SP4	5.14.21-150400.24.161.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.100.1 fixed

kernel-source

suse enterprise server 12 SP5	4.12.14-122.261.1 fixed
suse enterprise server 15 SP4	5.14.21-150400.24.161.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.100.1 fixed

kernel-syms

suse enterprise server 12 SP5	4.12.14-122.261.1 fixed
suse enterprise server 15 SP4	5.14.21-150400.24.161.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.100.1 fixed

kernel-zfcpdump

suse enterprise server 15 SP4	5.14.21-150400.24.161.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.100.1 fixed

ocfs2-kmp-default

suse enterprise server 12 SP5	4.12.14-122.261.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.100.1 fixed

reiserfs-kmp-default

suse enterprise server 15 SP4	5.14.21-150400.24.161.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.100.1 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

bpftool

RHEL 8.8 AUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.43.1.el8_8 fixed

kernel

RHEL 8.8 AUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.43.1.el8_8 fixed

kernel-abi-stablelists

RHEL 8.8 AUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.43.1.el8_8 fixed

kernel-core

RHEL 8.8 AUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.43.1.el8_8 fixed

kernel-debug

RHEL 8.8 AUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.43.1.el8_8 fixed

kernel-debug-core

RHEL 8.8 AUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.43.1.el8_8 fixed

kernel-debug-devel

RHEL 8.8 AUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.43.1.el8_8 fixed

kernel-debug-modules

RHEL 8.8 AUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.43.1.el8_8 fixed

kernel-debug-modules-extra

RHEL 8.8 AUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.43.1.el8_8 fixed

kernel-devel

RHEL 8.8 AUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.43.1.el8_8 fixed

kernel-doc

RHEL 8.8 AUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.43.1.el8_8 fixed

kernel-modules

RHEL 8.8 AUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.43.1.el8_8 fixed

kernel-modules-extra

RHEL 8.8 AUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.43.1.el8_8 fixed

kernel-tools

RHEL 8.8 AUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.43.1.el8_8 fixed

kernel-tools-libs

RHEL 8.8 AUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.43.1.el8_8 fixed

kernel-tools-libs-devel

RHEL 8.8 AUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.43.1.el8_8 fixed

kernel-zfcpdump

RHEL 8.8 AUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.43.1.el8_8 fixed

kernel-zfcpdump-core

RHEL 8.8 AUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.43.1.el8_8 fixed

kernel-zfcpdump-devel

RHEL 8.8 AUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.43.1.el8_8 fixed

kernel-zfcpdump-modules

RHEL 8.8 AUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.43.1.el8_8 fixed

kernel-zfcpdump-modules-extra

RHEL 8.8 AUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.43.1.el8_8 fixed

perf

RHEL 8.8 AUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.43.1.el8_8 fixed

python3-perf

RHEL 8.8 AUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 E4S	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 EUS	0:4.18.0-477.43.1.el8_8 fixed
RHEL 8.8 TUS	0:4.18.0-477.43.1.el8_8 fixed

Common Weakness Enumeration

CWE-416 - Use After Free
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

References

https://git.kernel.org/stable/c/0af745fddefbd56198f4f35eb309215ee5f9e21e

https://git.kernel.org/stable/c/17b738590b97fb3fc287289971d1519ff9b875a1

https://git.kernel.org/stable/c/6f1d64b13097e85abda0f91b5638000afc5f9a06

https://git.kernel.org/stable/c/8859687f5b242c0b057461df0a9ff51d5500783b