In the Linux kernel, the following vulnerability has been resolved:
scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write
During the sysfs firmware write process, a use-after-free read warning is logged from the lpfcwrobject() routine:
BUG: KFENCE: use-after-free read in lpfcwrobject+0x235/0x310 [lpfc] Use-after-free read at 0x0000000000cf164d (in kfence-#111): lpfcwrobject+0x235/0x310 [lpfc] lpfcwritefirmware.cold+0x206/0x30d [lpfc] lpfcsli4requestfirmwareupdate+0xa6/0x100 [lpfc] lpfcrequestfirmwareupgradestore+0x66/0xb0 [lpfc] kernfsfopwriteiter+0x121/0x1b0 newsyncwrite+0x11c/0x1b0 vfswrite+0x1ef/0x280 ksyswrite+0x5f/0xe0 dosyscall64+0x59/0x90 entrySYSCALL64after_hwframe+0x63/0xcd
The driver accessed wr_object pointer data, which was initialized into mailbox payload memory, after the mailbox object was released back to the mailbox pool.
Fix by moving the mailbox free calls to the end of the routine ensuring that we don't reference internal mailbox memory after release.
{ "vanir_signatures": [ { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/scsi/lpfc/lpfc_sli.c" }, "deprecated": false, "digest": { "line_hashes": [ "279904814649917902141150710391944447180", "146790323926901402697205603613776510564", "278892313432381631168521256224208362479", "187294393890113827939404633841474586220", "36836418013461253410448154334991618421", "61546868485540666271813982960597705259", "36436268085986067997349141395548073039", "147256626186636089863345725012962097891", "196541429926672434859770868568926150891", "163851143322550210457910750301846036234", "57067268768296152448642234950944473435", "246816285045202006131015070498968012236", "129482458389844632522700235761140429617", "85633015218412777133096512303594314606", "189428389879737234328087787133298156128", "57859733323682260984633388049769442400", "165184796158119105094487065106325236994", "308336792647753288651565607242267936618", "206896128675613712019355340496631518354", "4418531219989951346892723181363176230", "301255717064033576883338770039242336719", "54138894007772526233847989753906862709", "174724220825004794604104477274505100860" ], "threshold": 0.9 }, "id": "CVE-2023-53282-07d088fe", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8dfefa8f424ab208e552df1bfd008b732f3d0ad1" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/scsi/lpfc/lpfc_sli.c", "function": "lpfc_wr_object" }, "deprecated": false, "digest": { "length": 2697.0, "function_hash": "110015595883657262741198773407468915438" }, "id": "CVE-2023-53282-10380349", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@51ab4eb1a25e73c7fc2ad9026520c4d8369c93cc" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/scsi/lpfc/lpfc_sli.c", "function": "lpfc_wr_object" }, "deprecated": false, "digest": { "length": 2697.0, "function_hash": "110015595883657262741198773407468915438" }, "id": "CVE-2023-53282-68304f2b", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@21681b81b9ae548c5dae7ae00d931197a27f480c" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/scsi/lpfc/lpfc_sli.c" }, "deprecated": false, "digest": { "line_hashes": [ "279904814649917902141150710391944447180", "146790323926901402697205603613776510564", "278892313432381631168521256224208362479", "187294393890113827939404633841474586220", "36836418013461253410448154334991618421", "61546868485540666271813982960597705259", "36436268085986067997349141395548073039", "147256626186636089863345725012962097891", "196541429926672434859770868568926150891", "163851143322550210457910750301846036234", "57067268768296152448642234950944473435", "246816285045202006131015070498968012236", "129482458389844632522700235761140429617", "85633015218412777133096512303594314606", "189428389879737234328087787133298156128", "57859733323682260984633388049769442400", "165184796158119105094487065106325236994", "308336792647753288651565607242267936618", "206896128675613712019355340496631518354", "4418531219989951346892723181363176230", "301255717064033576883338770039242336719", "54138894007772526233847989753906862709", "174724220825004794604104477274505100860" ], "threshold": 0.9 }, "id": "CVE-2023-53282-7ac120db", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8becb97918f04bb177bc9c4e00c2bdb302e00944" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/scsi/lpfc/lpfc_sli.c" }, "deprecated": false, "digest": { "line_hashes": [ "279904814649917902141150710391944447180", "146790323926901402697205603613776510564", "278892313432381631168521256224208362479", "187294393890113827939404633841474586220", "36836418013461253410448154334991618421", "61546868485540666271813982960597705259", "36436268085986067997349141395548073039", "147256626186636089863345725012962097891", "196541429926672434859770868568926150891", "163851143322550210457910750301846036234", "57067268768296152448642234950944473435", "246816285045202006131015070498968012236", "129482458389844632522700235761140429617", "85633015218412777133096512303594314606", "189428389879737234328087787133298156128", "57859733323682260984633388049769442400", "165184796158119105094487065106325236994", "308336792647753288651565607242267936618", "206896128675613712019355340496631518354", "4418531219989951346892723181363176230", "301255717064033576883338770039242336719", "54138894007772526233847989753906862709", "174724220825004794604104477274505100860" ], "threshold": 0.9 }, "id": "CVE-2023-53282-8a169d90", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@21681b81b9ae548c5dae7ae00d931197a27f480c" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/scsi/lpfc/lpfc_sli.c", "function": "lpfc_wr_object" }, "deprecated": false, "digest": { "length": 2697.0, "function_hash": "110015595883657262741198773407468915438" }, "id": "CVE-2023-53282-abeab1f1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8becb97918f04bb177bc9c4e00c2bdb302e00944" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/scsi/lpfc/lpfc_sli.c" }, "deprecated": false, "digest": { "line_hashes": [ "279904814649917902141150710391944447180", "146790323926901402697205603613776510564", "278892313432381631168521256224208362479", "187294393890113827939404633841474586220", "36836418013461253410448154334991618421", "61546868485540666271813982960597705259", "36436268085986067997349141395548073039", "147256626186636089863345725012962097891", "196541429926672434859770868568926150891", "163851143322550210457910750301846036234", "57067268768296152448642234950944473435", "246816285045202006131015070498968012236", "129482458389844632522700235761140429617", "85633015218412777133096512303594314606", "189428389879737234328087787133298156128", "57859733323682260984633388049769442400", "165184796158119105094487065106325236994", "308336792647753288651565607242267936618", "206896128675613712019355340496631518354", "4418531219989951346892723181363176230", "301255717064033576883338770039242336719", "54138894007772526233847989753906862709", "174724220825004794604104477274505100860" ], "threshold": 0.9 }, "id": "CVE-2023-53282-c0a39986", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@51ab4eb1a25e73c7fc2ad9026520c4d8369c93cc" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/scsi/lpfc/lpfc_sli.c", "function": "lpfc_wr_object" }, "deprecated": false, "digest": { "length": 2697.0, "function_hash": "110015595883657262741198773407468915438" }, "id": "CVE-2023-53282-f1986a61", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8dfefa8f424ab208e552df1bfd008b732f3d0ad1" } ] }