In the Linux kernel, the following vulnerability has been resolved:
scsi: qla4xxx: Add length check when parsing nlattrs
There are three places that qla4xxx parses nlattrs:
qla4xxxsetchap_entry()
qla4xxxifaceset_param()
qla4xxxsysfsddbsetparam()
and each of them directly converts the nlattr to specific pointer of structure without length checking. This could be dangerous as those attributes are not validated and a malformed nlattr (e.g., length 0) could result in an OOB read that leaks heap dirty data.
Add the nla_len check before accessing the nlattr data and return EINVAL if the length check fails.
[
{
"deprecated": false,
"id": "CVE-2023-53456-24c0d404",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cfa6a1a79ed6d336fac7a5d87eb5471e4401829f",
"signature_version": "v1",
"target": {
"function": "qla4xxx_set_chap_entry",
"file": "drivers/scsi/qla4xxx/ql4_os.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "211241028574299459268454024765880196884",
"length": 2141.0
}
},
{
"deprecated": false,
"id": "CVE-2023-53456-34d94b97",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5925e224cc6edfef57b20447f18323208461309b",
"signature_version": "v1",
"target": {
"function": "qla4xxx_set_chap_entry",
"file": "drivers/scsi/qla4xxx/ql4_os.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "211241028574299459268454024765880196884",
"length": 2141.0
}
},
{
"deprecated": false,
"id": "CVE-2023-53456-56b84a0a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cfa6a1a79ed6d336fac7a5d87eb5471e4401829f",
"signature_version": "v1",
"target": {
"function": "qla4xxx_sysfs_ddb_set_param",
"file": "drivers/scsi/qla4xxx/ql4_os.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "212584760553697969729552856850537021103",
"length": 5873.0
}
},
{
"deprecated": false,
"id": "CVE-2023-53456-716889e5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5925e224cc6edfef57b20447f18323208461309b",
"signature_version": "v1",
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c"
},
"signature_type": "Line",
"digest": {
"line_hashes": [
"268363812237935287487601178379968562124",
"202342171917639544770016707679543411897",
"20775047463208341311940215575425655051",
"248919291957800566503451950147722768610",
"333108223054550065109294851201155409660",
"75397008217556031383041936020171218926",
"307630662496362302354025972749635697328",
"200330657609417865505842522839439472815",
"235701479077232664955302374568235983064",
"32470346438944667263002850588253730831",
"189500923495230325938352078514802592491",
"118181951935690122182938726272310514558"
],
"threshold": 0.9
}
},
{
"deprecated": false,
"id": "CVE-2023-53456-81704fbc",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5925e224cc6edfef57b20447f18323208461309b",
"signature_version": "v1",
"target": {
"function": "qla4xxx_sysfs_ddb_set_param",
"file": "drivers/scsi/qla4xxx/ql4_os.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "212584760553697969729552856850537021103",
"length": 5873.0
}
},
{
"deprecated": false,
"id": "CVE-2023-53456-95e83afc",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b018c0440b871d8b001c996e95fa4538bd292de6",
"signature_version": "v1",
"target": {
"function": "qla4xxx_sysfs_ddb_set_param",
"file": "drivers/scsi/qla4xxx/ql4_os.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "212584760553697969729552856850537021103",
"length": 5873.0
}
},
{
"deprecated": false,
"id": "CVE-2023-53456-ab4ed244",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b018c0440b871d8b001c996e95fa4538bd292de6",
"signature_version": "v1",
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c"
},
"signature_type": "Line",
"digest": {
"line_hashes": [
"268363812237935287487601178379968562124",
"202342171917639544770016707679543411897",
"20775047463208341311940215575425655051",
"248919291957800566503451950147722768610",
"333108223054550065109294851201155409660",
"75397008217556031383041936020171218926",
"307630662496362302354025972749635697328",
"200330657609417865505842522839439472815",
"235701479077232664955302374568235983064",
"32470346438944667263002850588253730831",
"189500923495230325938352078514802592491",
"118181951935690122182938726272310514558"
],
"threshold": 0.9
}
},
{
"deprecated": false,
"id": "CVE-2023-53456-aeda98ea",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5925e224cc6edfef57b20447f18323208461309b",
"signature_version": "v1",
"target": {
"function": "qla4xxx_iface_set_param",
"file": "drivers/scsi/qla4xxx/ql4_os.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "204317978903899348130102920164023177851",
"length": 2423.0
}
},
{
"deprecated": false,
"id": "CVE-2023-53456-de15bc82",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cfa6a1a79ed6d336fac7a5d87eb5471e4401829f",
"signature_version": "v1",
"target": {
"file": "drivers/scsi/qla4xxx/ql4_os.c"
},
"signature_type": "Line",
"digest": {
"line_hashes": [
"268363812237935287487601178379968562124",
"202342171917639544770016707679543411897",
"20775047463208341311940215575425655051",
"248919291957800566503451950147722768610",
"333108223054550065109294851201155409660",
"75397008217556031383041936020171218926",
"307630662496362302354025972749635697328",
"200330657609417865505842522839439472815",
"235701479077232664955302374568235983064",
"32470346438944667263002850588253730831",
"189500923495230325938352078514802592491",
"118181951935690122182938726272310514558"
],
"threshold": 0.9
}
},
{
"deprecated": false,
"id": "CVE-2023-53456-e3a09cbc",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b018c0440b871d8b001c996e95fa4538bd292de6",
"signature_version": "v1",
"target": {
"function": "qla4xxx_iface_set_param",
"file": "drivers/scsi/qla4xxx/ql4_os.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "204317978903899348130102920164023177851",
"length": 2423.0
}
},
{
"deprecated": false,
"id": "CVE-2023-53456-ed68a532",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b018c0440b871d8b001c996e95fa4538bd292de6",
"signature_version": "v1",
"target": {
"function": "qla4xxx_set_chap_entry",
"file": "drivers/scsi/qla4xxx/ql4_os.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "269261916548959822319531814485976064884",
"length": 2139.0
}
},
{
"deprecated": false,
"id": "CVE-2023-53456-f75fe1b8",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cfa6a1a79ed6d336fac7a5d87eb5471e4401829f",
"signature_version": "v1",
"target": {
"function": "qla4xxx_iface_set_param",
"file": "drivers/scsi/qla4xxx/ql4_os.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "231253067519383952686690903864430219864",
"length": 2465.0
}
}
]