In the Linux kernel, the following vulnerability has been resolved:
scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress
If during iscsiswtcpsessioncreate() iscsitcpr2tpoolalloc() fails, userspace could be accessing the host's ipaddress attr. If we then free the session via iscsisession_teardown() while userspace is still accessing the session we will hit a use after free bug.
Set the tcpswhost->session after we have completed session creation and can no longer fail.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52974.json",
"cna_assigner": "Linux"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-52974.json"
[
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"128702251137022799537321995553128087833",
"271036362467588879985928340221041299469",
"216222976205741338638157130930479678909",
"80748431606908518683320915781250036584",
"238746848092349850606261193353087843195",
"230275035056735670586270268033039188527",
"7293899213443230031618302966163893004",
"298095415156418441466592196337981593667",
"42148172351283020721526619606452286933",
"152206789454859409196857459032480779231",
"271558195331717354275389684254510030138",
"239751466794258150314395043448281266759",
"269399821965560669555391421326177755390",
"209727573734469481372272800973889233675",
"280079178543205141506023468922955789420",
"270420372670487500701240648664741326197"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9758ffe1c07b86aefd7ca8e40d9a461293427ca0",
"signature_type": "Line",
"id": "CVE-2023-52974-6b318113",
"target": {
"file": "drivers/scsi/iscsi_tcp.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "58529738036682659828152913673943435077",
"length": 902.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9758ffe1c07b86aefd7ca8e40d9a461293427ca0",
"signature_type": "Function",
"id": "CVE-2023-52974-b2435c88",
"target": {
"file": "drivers/scsi/iscsi_tcp.c",
"function": "iscsi_sw_tcp_host_get_param"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "23278994953422911018015889474187203733",
"length": 1005.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9758ffe1c07b86aefd7ca8e40d9a461293427ca0",
"signature_type": "Function",
"id": "CVE-2023-52974-e8cf7ec7",
"target": {
"file": "drivers/scsi/iscsi_tcp.c",
"function": "iscsi_sw_tcp_session_create"
}
}
]