In the Linux kernel, the following vulnerability has been resolved:
nvmet: avoid potential UAF in nvmetreqcomplete()
An nvme target ->queueresponse() operation implementation may free the request passed as argument. Such implementation potentially could result in a use after free of the request pointer when percpurefput() is called in nvmetreq_complete().
Avoid such problem by using a local variable to save the sq pointer before calling __nvmetreqcomplete(), thus avoiding dereferencing the req pointer after that function call.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53116.json",
"cna_assigner": "Linux"
}[
{
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "drivers/nvme/target/core.c"
},
"id": "CVE-2023-53116-1eee9b2d",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f1d5888a5efe345b63c430b256e95acb0a475642",
"digest": {
"line_hashes": [
"108857256040769022167598215945824766085",
"238181946144775628550008917407708488041",
"333197109882205849918236154448452129442",
"309373350101311567512550581557924931607",
"190559498276353321393539295703932041343",
"54898981316773466310283277483259865857"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "drivers/nvme/target/core.c",
"function": "nvmet_req_complete"
},
"id": "CVE-2023-53116-99379fee",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f1d5888a5efe345b63c430b256e95acb0a475642",
"digest": {
"function_hash": "39205024126308812362063342910353193640",
"length": 115.0
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53116.json"