In the Linux kernel, the following vulnerability has been resolved:
scsi: qla4xxx: Add length check when parsing nlattrs
There are three places that qla4xxx parses nlattrs:
qla4xxxsetchap_entry()
qla4xxxifaceset_param()
qla4xxxsysfsddbsetparam()
and each of them directly converts the nlattr to specific pointer of structure without length checking. This could be dangerous as those attributes are not validated and a malformed nlattr (e.g., length 0) could result in an OOB read that leaks heap dirty data.
Add the nla_len check before accessing the nlattr data and return EINVAL if the length check fails.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53456.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53456.json"
[
{
"signature_version": "v1",
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d65079c69dc1feb817ed71f5bd15e83a7d6832d",
"deprecated": false,
"digest": {
"line_hashes": [
"268363812237935287487601178379968562124",
"202342171917639544770016707679543411897",
"20775047463208341311940215575425655051",
"248919291957800566503451950147722768610",
"333108223054550065109294851201155409660",
"75397008217556031383041936020171218926",
"307630662496362302354025972749635697328",
"200330657609417865505842522839439472815",
"235701479077232664955302374568235983064",
"32470346438944667263002850588253730831",
"189500923495230325938352078514802592491",
"118181951935690122182938726272310514558"
],
"threshold": 0.9
},
"id": "CVE-2023-53456-2ee25165",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c",
"function": "qla4xxx_sysfs_ddb_set_param"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d65079c69dc1feb817ed71f5bd15e83a7d6832d",
"deprecated": false,
"digest": {
"function_hash": "212584760553697969729552856850537021103",
"length": 5873.0
},
"id": "CVE-2023-53456-7ee00eac",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c",
"function": "qla4xxx_set_chap_entry"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d65079c69dc1feb817ed71f5bd15e83a7d6832d",
"deprecated": false,
"digest": {
"function_hash": "269261916548959822319531814485976064884",
"length": 2139.0
},
"id": "CVE-2023-53456-845cd3fb",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c",
"function": "qla4xxx_iface_set_param"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d65079c69dc1feb817ed71f5bd15e83a7d6832d",
"deprecated": false,
"digest": {
"function_hash": "204317978903899348130102920164023177851",
"length": 2423.0
},
"id": "CVE-2023-53456-ed5052a2",
"signature_type": "Function"
}
]