In the Linux kernel, the following vulnerability has been resolved:
scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write
During the sysfs firmware write process, a use-after-free read warning is logged from the lpfcwrobject() routine:
BUG: KFENCE: use-after-free read in lpfcwrobject+0x235/0x310 [lpfc] Use-after-free read at 0x0000000000cf164d (in kfence-#111): lpfcwrobject+0x235/0x310 [lpfc] lpfcwritefirmware.cold+0x206/0x30d [lpfc] lpfcsli4requestfirmwareupdate+0xa6/0x100 [lpfc] lpfcrequestfirmwareupgradestore+0x66/0xb0 [lpfc] kernfsfopwriteiter+0x121/0x1b0 newsyncwrite+0x11c/0x1b0 vfswrite+0x1ef/0x280 ksyswrite+0x5f/0xe0 dosyscall64+0x59/0x90 entrySYSCALL64after_hwframe+0x63/0xcd
The driver accessed wr_object pointer data, which was initialized into mailbox payload memory, after the mailbox object was released back to the mailbox pool.
Fix by moving the mailbox free calls to the end of the routine ensuring that we don't reference internal mailbox memory after release.
[
{
"id": "CVE-2023-53282-07d088fe",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8dfefa8f424ab208e552df1bfd008b732f3d0ad1",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"279904814649917902141150710391944447180",
"146790323926901402697205603613776510564",
"278892313432381631168521256224208362479",
"187294393890113827939404633841474586220",
"36836418013461253410448154334991618421",
"61546868485540666271813982960597705259",
"36436268085986067997349141395548073039",
"147256626186636089863345725012962097891",
"196541429926672434859770868568926150891",
"163851143322550210457910750301846036234",
"57067268768296152448642234950944473435",
"246816285045202006131015070498968012236",
"129482458389844632522700235761140429617",
"85633015218412777133096512303594314606",
"189428389879737234328087787133298156128",
"57859733323682260984633388049769442400",
"165184796158119105094487065106325236994",
"308336792647753288651565607242267936618",
"206896128675613712019355340496631518354",
"4418531219989951346892723181363176230",
"301255717064033576883338770039242336719",
"54138894007772526233847989753906862709",
"174724220825004794604104477274505100860"
]
},
"target": {
"file": "drivers/scsi/lpfc/lpfc_sli.c"
}
},
{
"id": "CVE-2023-53282-10380349",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@51ab4eb1a25e73c7fc2ad9026520c4d8369c93cc",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "110015595883657262741198773407468915438",
"length": 2697.0
},
"target": {
"function": "lpfc_wr_object",
"file": "drivers/scsi/lpfc/lpfc_sli.c"
}
},
{
"id": "CVE-2023-53282-68304f2b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@21681b81b9ae548c5dae7ae00d931197a27f480c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "110015595883657262741198773407468915438",
"length": 2697.0
},
"target": {
"function": "lpfc_wr_object",
"file": "drivers/scsi/lpfc/lpfc_sli.c"
}
},
{
"id": "CVE-2023-53282-7ac120db",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8becb97918f04bb177bc9c4e00c2bdb302e00944",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"279904814649917902141150710391944447180",
"146790323926901402697205603613776510564",
"278892313432381631168521256224208362479",
"187294393890113827939404633841474586220",
"36836418013461253410448154334991618421",
"61546868485540666271813982960597705259",
"36436268085986067997349141395548073039",
"147256626186636089863345725012962097891",
"196541429926672434859770868568926150891",
"163851143322550210457910750301846036234",
"57067268768296152448642234950944473435",
"246816285045202006131015070498968012236",
"129482458389844632522700235761140429617",
"85633015218412777133096512303594314606",
"189428389879737234328087787133298156128",
"57859733323682260984633388049769442400",
"165184796158119105094487065106325236994",
"308336792647753288651565607242267936618",
"206896128675613712019355340496631518354",
"4418531219989951346892723181363176230",
"301255717064033576883338770039242336719",
"54138894007772526233847989753906862709",
"174724220825004794604104477274505100860"
]
},
"target": {
"file": "drivers/scsi/lpfc/lpfc_sli.c"
}
},
{
"id": "CVE-2023-53282-8a169d90",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@21681b81b9ae548c5dae7ae00d931197a27f480c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"279904814649917902141150710391944447180",
"146790323926901402697205603613776510564",
"278892313432381631168521256224208362479",
"187294393890113827939404633841474586220",
"36836418013461253410448154334991618421",
"61546868485540666271813982960597705259",
"36436268085986067997349141395548073039",
"147256626186636089863345725012962097891",
"196541429926672434859770868568926150891",
"163851143322550210457910750301846036234",
"57067268768296152448642234950944473435",
"246816285045202006131015070498968012236",
"129482458389844632522700235761140429617",
"85633015218412777133096512303594314606",
"189428389879737234328087787133298156128",
"57859733323682260984633388049769442400",
"165184796158119105094487065106325236994",
"308336792647753288651565607242267936618",
"206896128675613712019355340496631518354",
"4418531219989951346892723181363176230",
"301255717064033576883338770039242336719",
"54138894007772526233847989753906862709",
"174724220825004794604104477274505100860"
]
},
"target": {
"file": "drivers/scsi/lpfc/lpfc_sli.c"
}
},
{
"id": "CVE-2023-53282-abeab1f1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8becb97918f04bb177bc9c4e00c2bdb302e00944",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "110015595883657262741198773407468915438",
"length": 2697.0
},
"target": {
"function": "lpfc_wr_object",
"file": "drivers/scsi/lpfc/lpfc_sli.c"
}
},
{
"id": "CVE-2023-53282-c0a39986",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@51ab4eb1a25e73c7fc2ad9026520c4d8369c93cc",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"279904814649917902141150710391944447180",
"146790323926901402697205603613776510564",
"278892313432381631168521256224208362479",
"187294393890113827939404633841474586220",
"36836418013461253410448154334991618421",
"61546868485540666271813982960597705259",
"36436268085986067997349141395548073039",
"147256626186636089863345725012962097891",
"196541429926672434859770868568926150891",
"163851143322550210457910750301846036234",
"57067268768296152448642234950944473435",
"246816285045202006131015070498968012236",
"129482458389844632522700235761140429617",
"85633015218412777133096512303594314606",
"189428389879737234328087787133298156128",
"57859733323682260984633388049769442400",
"165184796158119105094487065106325236994",
"308336792647753288651565607242267936618",
"206896128675613712019355340496631518354",
"4418531219989951346892723181363176230",
"301255717064033576883338770039242336719",
"54138894007772526233847989753906862709",
"174724220825004794604104477274505100860"
]
},
"target": {
"file": "drivers/scsi/lpfc/lpfc_sli.c"
}
},
{
"id": "CVE-2023-53282-f1986a61",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8dfefa8f424ab208e552df1bfd008b732f3d0ad1",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "110015595883657262741198773407468915438",
"length": 2697.0
},
"target": {
"function": "lpfc_wr_object",
"file": "drivers/scsi/lpfc/lpfc_sli.c"
}
}
]