In the Linux kernel, the following vulnerability has been resolved:
nvmet: avoid potential UAF in nvmetreqcomplete()
An nvme target ->queueresponse() operation implementation may free the request passed as argument. Such implementation potentially could result in a use after free of the request pointer when percpurefput() is called in nvmetreq_complete().
Avoid such problem by using a local variable to save the sq pointer before calling _nvmetreq_complete(), thus avoiding dereferencing the req pointer after that function call.
{ "vanir_signatures": [ { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/nvme/target/core.c", "function": "nvmet_req_complete" }, "signature_version": "v1", "digest": { "length": 115.0, "function_hash": "39205024126308812362063342910353193640" }, "id": "CVE-2023-53116-09498fb8", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ed9813871038b25a934b21ab76b5b7dbf44fc3a" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/nvme/target/core.c", "function": "nvmet_req_complete" }, "signature_version": "v1", "digest": { "length": 115.0, "function_hash": "39205024126308812362063342910353193640" }, "id": "CVE-2023-53116-0c2dfdaf", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@04c394208831d5e0d5cfee46722eb0f033cd4083" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/nvme/target/core.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "108857256040769022167598215945824766085", "238181946144775628550008917407708488041", "333197109882205849918236154448452129442", "309373350101311567512550581557924931607", "190559498276353321393539295703932041343", "54898981316773466310283277483259865857" ], "threshold": 0.9 }, "id": "CVE-2023-53116-1eee9b2d", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f1d5888a5efe345b63c430b256e95acb0a475642" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/nvme/target/core.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "108857256040769022167598215945824766085", "238181946144775628550008917407708488041", "333197109882205849918236154448452129442", "309373350101311567512550581557924931607", "190559498276353321393539295703932041343", "54898981316773466310283277483259865857" ], "threshold": 0.9 }, "id": "CVE-2023-53116-345370fb", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fafcb4b26393870c45462f9af6a48e581dbbcf7e" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/nvme/target/core.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "244213728531309343392355203245398743684", "238181946144775628550008917407708488041", "333197109882205849918236154448452129442", "309373350101311567512550581557924931607", "190559498276353321393539295703932041343", "54898981316773466310283277483259865857" ], "threshold": 0.9 }, "id": "CVE-2023-53116-3877f11e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5d99b29012bbf0e86929403209723b2806500c1" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/nvme/target/core.c", "function": "nvmet_req_complete" }, "signature_version": "v1", "digest": { "length": 115.0, "function_hash": "39205024126308812362063342910353193640" }, "id": "CVE-2023-53116-40918ea5", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fafcb4b26393870c45462f9af6a48e581dbbcf7e" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/nvme/target/core.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "108857256040769022167598215945824766085", "238181946144775628550008917407708488041", "333197109882205849918236154448452129442", "309373350101311567512550581557924931607", "190559498276353321393539295703932041343", "54898981316773466310283277483259865857" ], "threshold": 0.9 }, "id": "CVE-2023-53116-52772083", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ed9813871038b25a934b21ab76b5b7dbf44fc3a" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/nvme/target/core.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "108857256040769022167598215945824766085", "238181946144775628550008917407708488041", "333197109882205849918236154448452129442", "309373350101311567512550581557924931607", "190559498276353321393539295703932041343", "54898981316773466310283277483259865857" ], "threshold": 0.9 }, "id": "CVE-2023-53116-6166131c", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6317235da8aa7cb97529ebc8121cc2a4c4c437a" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/nvme/target/core.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "108857256040769022167598215945824766085", "238181946144775628550008917407708488041", "333197109882205849918236154448452129442", "309373350101311567512550581557924931607", "190559498276353321393539295703932041343", "54898981316773466310283277483259865857" ], "threshold": 0.9 }, "id": "CVE-2023-53116-899a42ff", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6173a77b7e9d3e202bdb9897b23f2a8afe7bf286" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/nvme/target/core.c", "function": "nvmet_req_complete" }, "signature_version": "v1", "digest": { "length": 115.0, "function_hash": "39205024126308812362063342910353193640" }, "id": "CVE-2023-53116-99379fee", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f1d5888a5efe345b63c430b256e95acb0a475642" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/nvme/target/core.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "108857256040769022167598215945824766085", "238181946144775628550008917407708488041", "333197109882205849918236154448452129442", "309373350101311567512550581557924931607", "190559498276353321393539295703932041343", "54898981316773466310283277483259865857" ], "threshold": 0.9 }, "id": "CVE-2023-53116-ab18f8b7", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@04c394208831d5e0d5cfee46722eb0f033cd4083" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/nvme/target/core.c", "function": "nvmet_req_complete" }, "signature_version": "v1", "digest": { "length": 115.0, "function_hash": "39205024126308812362063342910353193640" }, "id": "CVE-2023-53116-b6a9f29e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6317235da8aa7cb97529ebc8121cc2a4c4c437a" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/nvme/target/core.c", "function": "nvmet_req_complete" }, "signature_version": "v1", "digest": { "length": 115.0, "function_hash": "39205024126308812362063342910353193640" }, "id": "CVE-2023-53116-c054082d", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5d99b29012bbf0e86929403209723b2806500c1" }, { "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/nvme/target/core.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "108857256040769022167598215945824766085", "238181946144775628550008917407708488041", "333197109882205849918236154448452129442", "309373350101311567512550581557924931607", "190559498276353321393539295703932041343", "54898981316773466310283277483259865857" ], "threshold": 0.9 }, "id": "CVE-2023-53116-e6d8cc97", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bcd535f07c58342302a2cd2bdd8894fe0872c8a9" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/nvme/target/core.c", "function": "nvmet_req_complete" }, "signature_version": "v1", "digest": { "length": 115.0, "function_hash": "39205024126308812362063342910353193640" }, "id": "CVE-2023-53116-f1f1e6d4", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6173a77b7e9d3e202bdb9897b23f2a8afe7bf286" }, { "deprecated": false, "signature_type": "Function", "target": { "file": "drivers/nvme/target/core.c", "function": "nvmet_req_complete" }, "signature_version": "v1", "digest": { "length": 115.0, "function_hash": "39205024126308812362063342910353193640" }, "id": "CVE-2023-53116-f54fc849", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bcd535f07c58342302a2cd2bdd8894fe0872c8a9" } ] }