In the Linux kernel, the following vulnerability has been resolved:
scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress
If during iscsiswtcpsessioncreate() iscsitcpr2tpoolalloc() fails, userspace could be accessing the host's ipaddress attr. If we then free the session via iscsisession_teardown() while userspace is still accessing the session we will hit a use after free bug.
Set the tcpswhost->session after we have completed session creation and can no longer fail.
[
{
"deprecated": false,
"id": "CVE-2023-52974-02d8b714",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@496af9d3682ed4c28fb734342a09e6cc0c056ea4",
"signature_version": "v1",
"target": {
"function": "iscsi_sw_tcp_session_create",
"file": "drivers/scsi/iscsi_tcp.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "23278994953422911018015889474187203733",
"length": 1005.0
}
},
{
"deprecated": false,
"id": "CVE-2023-52974-189f6332",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0aaabdb900c7415caa2006ef580322f7eac5f6b6",
"signature_version": "v1",
"target": {
"function": "iscsi_sw_tcp_session_create",
"file": "drivers/scsi/iscsi_tcp.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "37694107532529169236564534944079591369",
"length": 1073.0
}
},
{
"deprecated": false,
"id": "CVE-2023-52974-3dc8dbaa",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d4d765f4761f9e3a2d62992f825aeee593bcb6b9",
"signature_version": "v1",
"target": {
"file": "drivers/scsi/iscsi_tcp.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"128702251137022799537321995553128087833",
"271036362467588879985928340221041299469",
"216222976205741338638157130930479678909",
"80748431606908518683320915781250036584",
"24342834822126768392691512686436325567",
"230275035056735670586270268033039188527",
"7293899213443230031618302966163893004",
"298095415156418441466592196337981593667",
"42148172351283020721526619606452286933",
"152206789454859409196857459032480779231",
"271558195331717354275389684254510030138",
"239751466794258150314395043448281266759",
"269399821965560669555391421326177755390",
"209727573734469481372272800973889233675",
"280079178543205141506023468922955789420",
"270420372670487500701240648664741326197"
]
}
},
{
"deprecated": false,
"id": "CVE-2023-52974-55fc90ce",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f484a794e4ee2a9ce61f52a78e810ac45f3fe3b3",
"signature_version": "v1",
"target": {
"file": "drivers/scsi/iscsi_tcp.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"128702251137022799537321995553128087833",
"271036362467588879985928340221041299469",
"216222976205741338638157130930479678909",
"80748431606908518683320915781250036584",
"238746848092349850606261193353087843195",
"230275035056735670586270268033039188527",
"7293899213443230031618302966163893004",
"298095415156418441466592196337981593667",
"42148172351283020721526619606452286933",
"152206789454859409196857459032480779231",
"265926025012118271812143951549805228386",
"266496000845535767066472294398047282874",
"335736153068704916810209017005332046523",
"280079178543205141506023468922955789420",
"270420372670487500701240648664741326197"
]
}
},
{
"deprecated": false,
"id": "CVE-2023-52974-5d7c4920",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d4d765f4761f9e3a2d62992f825aeee593bcb6b9",
"signature_version": "v1",
"target": {
"function": "iscsi_sw_tcp_session_create",
"file": "drivers/scsi/iscsi_tcp.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "23278994953422911018015889474187203733",
"length": 1005.0
}
},
{
"deprecated": false,
"id": "CVE-2023-52974-5f21852e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0aaabdb900c7415caa2006ef580322f7eac5f6b6",
"signature_version": "v1",
"target": {
"function": "iscsi_sw_tcp_host_get_param",
"file": "drivers/scsi/iscsi_tcp.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "58529738036682659828152913673943435077",
"length": 902.0
}
},
{
"deprecated": false,
"id": "CVE-2023-52974-688a8ed7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@496af9d3682ed4c28fb734342a09e6cc0c056ea4",
"signature_version": "v1",
"target": {
"function": "iscsi_sw_tcp_host_get_param",
"file": "drivers/scsi/iscsi_tcp.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "274571745196532769356748895425416930566",
"length": 799.0
}
},
{
"deprecated": false,
"id": "CVE-2023-52974-6b318113",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9758ffe1c07b86aefd7ca8e40d9a461293427ca0",
"signature_version": "v1",
"target": {
"file": "drivers/scsi/iscsi_tcp.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"128702251137022799537321995553128087833",
"271036362467588879985928340221041299469",
"216222976205741338638157130930479678909",
"80748431606908518683320915781250036584",
"238746848092349850606261193353087843195",
"230275035056735670586270268033039188527",
"7293899213443230031618302966163893004",
"298095415156418441466592196337981593667",
"42148172351283020721526619606452286933",
"152206789454859409196857459032480779231",
"271558195331717354275389684254510030138",
"239751466794258150314395043448281266759",
"269399821965560669555391421326177755390",
"209727573734469481372272800973889233675",
"280079178543205141506023468922955789420",
"270420372670487500701240648664741326197"
]
}
},
{
"deprecated": false,
"id": "CVE-2023-52974-76027c3d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@496af9d3682ed4c28fb734342a09e6cc0c056ea4",
"signature_version": "v1",
"target": {
"file": "drivers/scsi/iscsi_tcp.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"128702251137022799537321995553128087833",
"271036362467588879985928340221041299469",
"216222976205741338638157130930479678909",
"80748431606908518683320915781250036584",
"117852363234567195242582990226094151279",
"319931669685217524816839114447778359646",
"7293899213443230031618302966163893004",
"298095415156418441466592196337981593667",
"42148172351283020721526619606452286933",
"152206789454859409196857459032480779231",
"271558195331717354275389684254510030138",
"239751466794258150314395043448281266759",
"269399821965560669555391421326177755390",
"209727573734469481372272800973889233675",
"280079178543205141506023468922955789420",
"270420372670487500701240648664741326197"
]
}
},
{
"deprecated": false,
"id": "CVE-2023-52974-8e14fa67",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6abd4698f4c8a78e7bbfc421205c060c199554a0",
"signature_version": "v1",
"target": {
"file": "drivers/scsi/iscsi_tcp.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"128702251137022799537321995553128087833",
"271036362467588879985928340221041299469",
"216222976205741338638157130930479678909",
"80748431606908518683320915781250036584",
"24342834822126768392691512686436325567",
"230275035056735670586270268033039188527",
"7293899213443230031618302966163893004",
"298095415156418441466592196337981593667",
"42148172351283020721526619606452286933",
"152206789454859409196857459032480779231",
"271558195331717354275389684254510030138",
"239751466794258150314395043448281266759",
"269399821965560669555391421326177755390",
"209727573734469481372272800973889233675",
"280079178543205141506023468922955789420",
"270420372670487500701240648664741326197"
]
}
},
{
"deprecated": false,
"id": "CVE-2023-52974-925ffc92",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0aaabdb900c7415caa2006ef580322f7eac5f6b6",
"signature_version": "v1",
"target": {
"file": "drivers/scsi/iscsi_tcp.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"128702251137022799537321995553128087833",
"271036362467588879985928340221041299469",
"216222976205741338638157130930479678909",
"80748431606908518683320915781250036584",
"238746848092349850606261193353087843195",
"230275035056735670586270268033039188527",
"7293899213443230031618302966163893004",
"298095415156418441466592196337981593667",
"42148172351283020721526619606452286933",
"152206789454859409196857459032480779231",
"265926025012118271812143951549805228386",
"266496000845535767066472294398047282874",
"335736153068704916810209017005332046523",
"280079178543205141506023468922955789420",
"270420372670487500701240648664741326197"
]
}
},
{
"deprecated": false,
"id": "CVE-2023-52974-a97e167c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f484a794e4ee2a9ce61f52a78e810ac45f3fe3b3",
"signature_version": "v1",
"target": {
"function": "iscsi_sw_tcp_session_create",
"file": "drivers/scsi/iscsi_tcp.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "37694107532529169236564534944079591369",
"length": 1073.0
}
},
{
"deprecated": false,
"id": "CVE-2023-52974-b2435c88",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9758ffe1c07b86aefd7ca8e40d9a461293427ca0",
"signature_version": "v1",
"target": {
"function": "iscsi_sw_tcp_host_get_param",
"file": "drivers/scsi/iscsi_tcp.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "58529738036682659828152913673943435077",
"length": 902.0
}
},
{
"deprecated": false,
"id": "CVE-2023-52974-c903517a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f484a794e4ee2a9ce61f52a78e810ac45f3fe3b3",
"signature_version": "v1",
"target": {
"function": "iscsi_sw_tcp_host_get_param",
"file": "drivers/scsi/iscsi_tcp.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "58529738036682659828152913673943435077",
"length": 902.0
}
},
{
"deprecated": false,
"id": "CVE-2023-52974-cd32437f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d4d765f4761f9e3a2d62992f825aeee593bcb6b9",
"signature_version": "v1",
"target": {
"function": "iscsi_sw_tcp_host_get_param",
"file": "drivers/scsi/iscsi_tcp.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "242667648852782543929678861693374408473",
"length": 789.0
}
},
{
"deprecated": false,
"id": "CVE-2023-52974-d829a7c3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@61e43ebfd243bcbad11be26bd921723027b77441",
"signature_version": "v1",
"target": {
"function": "iscsi_sw_tcp_session_create",
"file": "drivers/scsi/iscsi_tcp.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "37694107532529169236564534944079591369",
"length": 1073.0
}
},
{
"deprecated": false,
"id": "CVE-2023-52974-e5f77baa",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@61e43ebfd243bcbad11be26bd921723027b77441",
"signature_version": "v1",
"target": {
"function": "iscsi_sw_tcp_host_get_param",
"file": "drivers/scsi/iscsi_tcp.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "58529738036682659828152913673943435077",
"length": 902.0
}
},
{
"deprecated": false,
"id": "CVE-2023-52974-e8cf7ec7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9758ffe1c07b86aefd7ca8e40d9a461293427ca0",
"signature_version": "v1",
"target": {
"function": "iscsi_sw_tcp_session_create",
"file": "drivers/scsi/iscsi_tcp.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "23278994953422911018015889474187203733",
"length": 1005.0
}
},
{
"deprecated": false,
"id": "CVE-2023-52974-eb0d819f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6abd4698f4c8a78e7bbfc421205c060c199554a0",
"signature_version": "v1",
"target": {
"function": "iscsi_sw_tcp_host_get_param",
"file": "drivers/scsi/iscsi_tcp.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "242667648852782543929678861693374408473",
"length": 789.0
}
},
{
"deprecated": false,
"id": "CVE-2023-52974-f422cd1f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@61e43ebfd243bcbad11be26bd921723027b77441",
"signature_version": "v1",
"target": {
"file": "drivers/scsi/iscsi_tcp.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"128702251137022799537321995553128087833",
"271036362467588879985928340221041299469",
"216222976205741338638157130930479678909",
"80748431606908518683320915781250036584",
"238746848092349850606261193353087843195",
"230275035056735670586270268033039188527",
"7293899213443230031618302966163893004",
"298095415156418441466592196337981593667",
"42148172351283020721526619606452286933",
"152206789454859409196857459032480779231",
"265926025012118271812143951549805228386",
"266496000845535767066472294398047282874",
"335736153068704916810209017005332046523",
"280079178543205141506023468922955789420",
"270420372670487500701240648664741326197"
]
}
},
{
"deprecated": false,
"id": "CVE-2023-52974-fbb30878",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6abd4698f4c8a78e7bbfc421205c060c199554a0",
"signature_version": "v1",
"target": {
"function": "iscsi_sw_tcp_session_create",
"file": "drivers/scsi/iscsi_tcp.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "23278994953422911018015889474187203733",
"length": 1005.0
}
}
]