In the Linux kernel, the following vulnerability has been resolved:
nvmet: avoid potential UAF in nvmetreqcomplete()
An nvme target ->queueresponse() operation implementation may free the request passed as argument. Such implementation potentially could result in a use after free of the request pointer when percpurefput() is called in nvmetreq_complete().
Avoid such problem by using a local variable to save the sq pointer before calling _nvmetreq_complete(), thus avoiding dereferencing the req pointer after that function call.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53116.json",
"cna_assigner": "Linux"
}[
{
"id": "CVE-2023-53116-09498fb8",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ed9813871038b25a934b21ab76b5b7dbf44fc3a",
"target": {
"function": "nvmet_req_complete",
"file": "drivers/nvme/target/core.c"
},
"digest": {
"length": 115.0,
"function_hash": "39205024126308812362063342910353193640"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53116-0c2dfdaf",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@04c394208831d5e0d5cfee46722eb0f033cd4083",
"target": {
"function": "nvmet_req_complete",
"file": "drivers/nvme/target/core.c"
},
"digest": {
"length": 115.0,
"function_hash": "39205024126308812362063342910353193640"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53116-1eee9b2d",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f1d5888a5efe345b63c430b256e95acb0a475642",
"target": {
"file": "drivers/nvme/target/core.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"108857256040769022167598215945824766085",
"238181946144775628550008917407708488041",
"333197109882205849918236154448452129442",
"309373350101311567512550581557924931607",
"190559498276353321393539295703932041343",
"54898981316773466310283277483259865857"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53116-345370fb",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fafcb4b26393870c45462f9af6a48e581dbbcf7e",
"target": {
"file": "drivers/nvme/target/core.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"108857256040769022167598215945824766085",
"238181946144775628550008917407708488041",
"333197109882205849918236154448452129442",
"309373350101311567512550581557924931607",
"190559498276353321393539295703932041343",
"54898981316773466310283277483259865857"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53116-3877f11e",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5d99b29012bbf0e86929403209723b2806500c1",
"target": {
"file": "drivers/nvme/target/core.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"244213728531309343392355203245398743684",
"238181946144775628550008917407708488041",
"333197109882205849918236154448452129442",
"309373350101311567512550581557924931607",
"190559498276353321393539295703932041343",
"54898981316773466310283277483259865857"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53116-40918ea5",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fafcb4b26393870c45462f9af6a48e581dbbcf7e",
"target": {
"function": "nvmet_req_complete",
"file": "drivers/nvme/target/core.c"
},
"digest": {
"length": 115.0,
"function_hash": "39205024126308812362063342910353193640"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53116-52772083",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ed9813871038b25a934b21ab76b5b7dbf44fc3a",
"target": {
"file": "drivers/nvme/target/core.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"108857256040769022167598215945824766085",
"238181946144775628550008917407708488041",
"333197109882205849918236154448452129442",
"309373350101311567512550581557924931607",
"190559498276353321393539295703932041343",
"54898981316773466310283277483259865857"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53116-6166131c",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6317235da8aa7cb97529ebc8121cc2a4c4c437a",
"target": {
"file": "drivers/nvme/target/core.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"108857256040769022167598215945824766085",
"238181946144775628550008917407708488041",
"333197109882205849918236154448452129442",
"309373350101311567512550581557924931607",
"190559498276353321393539295703932041343",
"54898981316773466310283277483259865857"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53116-899a42ff",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6173a77b7e9d3e202bdb9897b23f2a8afe7bf286",
"target": {
"file": "drivers/nvme/target/core.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"108857256040769022167598215945824766085",
"238181946144775628550008917407708488041",
"333197109882205849918236154448452129442",
"309373350101311567512550581557924931607",
"190559498276353321393539295703932041343",
"54898981316773466310283277483259865857"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53116-99379fee",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f1d5888a5efe345b63c430b256e95acb0a475642",
"target": {
"function": "nvmet_req_complete",
"file": "drivers/nvme/target/core.c"
},
"digest": {
"length": 115.0,
"function_hash": "39205024126308812362063342910353193640"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53116-ab18f8b7",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@04c394208831d5e0d5cfee46722eb0f033cd4083",
"target": {
"file": "drivers/nvme/target/core.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"108857256040769022167598215945824766085",
"238181946144775628550008917407708488041",
"333197109882205849918236154448452129442",
"309373350101311567512550581557924931607",
"190559498276353321393539295703932041343",
"54898981316773466310283277483259865857"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53116-b6a9f29e",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6317235da8aa7cb97529ebc8121cc2a4c4c437a",
"target": {
"function": "nvmet_req_complete",
"file": "drivers/nvme/target/core.c"
},
"digest": {
"length": 115.0,
"function_hash": "39205024126308812362063342910353193640"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53116-c054082d",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5d99b29012bbf0e86929403209723b2806500c1",
"target": {
"function": "nvmet_req_complete",
"file": "drivers/nvme/target/core.c"
},
"digest": {
"length": 115.0,
"function_hash": "39205024126308812362063342910353193640"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53116-e6d8cc97",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bcd535f07c58342302a2cd2bdd8894fe0872c8a9",
"target": {
"file": "drivers/nvme/target/core.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"108857256040769022167598215945824766085",
"238181946144775628550008917407708488041",
"333197109882205849918236154448452129442",
"309373350101311567512550581557924931607",
"190559498276353321393539295703932041343",
"54898981316773466310283277483259865857"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53116-f1f1e6d4",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6173a77b7e9d3e202bdb9897b23f2a8afe7bf286",
"target": {
"function": "nvmet_req_complete",
"file": "drivers/nvme/target/core.c"
},
"digest": {
"length": 115.0,
"function_hash": "39205024126308812362063342910353193640"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53116-f54fc849",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bcd535f07c58342302a2cd2bdd8894fe0872c8a9",
"target": {
"function": "nvmet_req_complete",
"file": "drivers/nvme/target/core.c"
},
"digest": {
"length": 115.0,
"function_hash": "39205024126308812362063342910353193640"
},
"signature_type": "Function"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53116.json"