CVE-2023-52811

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-52811
In the Linux kernel, the following vulnerability has been resolved: scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool In practice the driver should never send more commands than are allocated to a queue's event pool. In the unlikely event that this happens, the code asserts a BUG_ON, and in the case that the kernel is not configured to crash on panic returns a junk event pointer from the empty event list causing things to spiral from there. This BUG_ON is a historical artifact of the ibmvfc driver first being upstreamed, and it is well known now that the use of BUG_ON is bad practice except in the most unrecoverable scenario. There is nothing about this scenario that prevents the driver from recovering and carrying on. Remove the BUG_ON in question from ibmvfc_get_event() and return a NULL pointer in the case of an empty event pool. Update all call sites to ibmvfc_get_event() to check for a NULL pointer and perfrom the appropriate failure or recovery action.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/88984ec4792766df5a9de7a2ff2b5f281f94c7d4 Patch
https://git.kernel.org/stable/c/8bbe784c2ff28d56ca0c548aaf3e584edc77052d Patch
https://git.kernel.org/stable/c/b39f2d10b86d0af353ea339e5815820026bca48f Patch
https://git.kernel.org/stable/c/d2af4ef80601224b90630c1ddc7cd2c7c8ab4dd8 Patch
https://git.kernel.org/stable/c/e1d1f79b1929dce470a5dc9281c574cd58e8c6c0 Patch
https://git.kernel.org/stable/c/88984ec4792766df5a9de7a2ff2b5f281f94c7d4 Patch
https://git.kernel.org/stable/c/8bbe784c2ff28d56ca0c548aaf3e584edc77052d Patch
https://git.kernel.org/stable/c/b39f2d10b86d0af353ea339e5815820026bca48f Patch
https://git.kernel.org/stable/c/d2af4ef80601224b90630c1ddc7cd2c7c8ab4dd8 Patch
https://git.kernel.org/stable/c/e1d1f79b1929dce470a5dc9281c574cd58e8c6c0 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

02 Apr 2025, 15:00

Type Values Removed Values Added
CWE CWE-476
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/88984ec4792766df5a9de7a2ff2b5f281f94c7d4 - () https://git.kernel.org/stable/c/88984ec4792766df5a9de7a2ff2b5f281f94c7d4 - Patch
References () https://git.kernel.org/stable/c/8bbe784c2ff28d56ca0c548aaf3e584edc77052d - () https://git.kernel.org/stable/c/8bbe784c2ff28d56ca0c548aaf3e584edc77052d - Patch
References () https://git.kernel.org/stable/c/b39f2d10b86d0af353ea339e5815820026bca48f - () https://git.kernel.org/stable/c/b39f2d10b86d0af353ea339e5815820026bca48f - Patch
References () https://git.kernel.org/stable/c/d2af4ef80601224b90630c1ddc7cd2c7c8ab4dd8 - () https://git.kernel.org/stable/c/d2af4ef80601224b90630c1ddc7cd2c7c8ab4dd8 - Patch
References () https://git.kernel.org/stable/c/e1d1f79b1929dce470a5dc9281c574cd58e8c6c0 - () https://git.kernel.org/stable/c/e1d1f79b1929dce470a5dc9281c574cd58e8c6c0 - Patch

21 Nov 2024, 08:40

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/88984ec4792766df5a9de7a2ff2b5f281f94c7d4 - () https://git.kernel.org/stable/c/88984ec4792766df5a9de7a2ff2b5f281f94c7d4 -
References () https://git.kernel.org/stable/c/8bbe784c2ff28d56ca0c548aaf3e584edc77052d - () https://git.kernel.org/stable/c/8bbe784c2ff28d56ca0c548aaf3e584edc77052d -
References () https://git.kernel.org/stable/c/b39f2d10b86d0af353ea339e5815820026bca48f - () https://git.kernel.org/stable/c/b39f2d10b86d0af353ea339e5815820026bca48f -
References () https://git.kernel.org/stable/c/d2af4ef80601224b90630c1ddc7cd2c7c8ab4dd8 - () https://git.kernel.org/stable/c/d2af4ef80601224b90630c1ddc7cd2c7c8ab4dd8 -
References () https://git.kernel.org/stable/c/e1d1f79b1929dce470a5dc9281c574cd58e8c6c0 - () https://git.kernel.org/stable/c/e1d1f79b1929dce470a5dc9281c574cd58e8c6c0 -

31 Oct 2024, 15:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: ibmvfc: Eliminar BUG_ON en el caso de un grupo de eventos vacío. En la práctica, el controlador nunca debe enviar más comandos de los asignados al grupo de eventos de una cola. En el improbable caso de que esto suceda, el código afirma un BUG_ON, y en el caso de que el kernel no esté configurado para fallar en caso de pánico, devuelve un puntero de evento basura de la lista de eventos vacía, lo que hace que las cosas vayan en espiral a partir de ahí. Este BUG_ON es un artefacto histórico del controlador ibmvfc que se actualizó por primera vez, y ahora es bien sabido que el uso de BUG_ON es una mala práctica, excepto en el escenario más irrecuperable. No hay nada en este escenario que impida al conductor recuperarse y continuar. Elimine el BUG_ON en cuestión de ibmvfc_get_event() y devuelva un puntero NULL en el caso de un grupo de eventos vacío. Actualice todos los sitios de llamadas a ibmvfc_get_event() para comprobar si hay un puntero NULL y realizar la acción de recuperación o error adecuada.

21 May 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-21 16:15

Updated : 2025-04-02 15:00

NVD link : CVE-2023-52811

Mitre link : CVE-2023-52811

CVE.ORG link : CVE-2023-52811

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference