CVE-2023-52454

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-52454
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length If the host sends an H2CData command with an invalid DATAL, the kernel may crash in nvmet_tcp_build_pdu_iovec(). Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 lr : nvmet_tcp_io_work+0x6ac/0x718 [nvmet_tcp] Call trace: process_one_work+0x174/0x3c8 worker_thread+0x2d0/0x3e8 kthread+0x104/0x110 Fix the bug by raising a fatal error if DATAL isn't coherent with the packet size. Also, the PDU length should never exceed the MAXH2CDATA parameter which has been communicated to the host in nvmet_tcp_handle_icreq().

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/24e05760186dc070d3db190ca61efdbce23afc88 Patch
https://git.kernel.org/stable/c/2871aa407007f6f531fae181ad252486e022df42 Patch
https://git.kernel.org/stable/c/4cb3cf7177ae3666be7fb27d4ad4d72a295fb02d Patch
https://git.kernel.org/stable/c/70154e8d015c9b4fb56c1a2ef1fc8b83d45c7f68 Patch
https://git.kernel.org/stable/c/ee5e7632e981673f42a50ade25e71e612e543d9d Patch
https://git.kernel.org/stable/c/efa56305908ba20de2104f1b8508c6a7401833be Patch
https://git.kernel.org/stable/c/f775f2621c2ac5cc3a0b3a64665dad4fb146e510 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

19 Apr 2024, 18:40

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
References () https://git.kernel.org/stable/c/24e05760186dc070d3db190ca61efdbce23afc88 - () https://git.kernel.org/stable/c/24e05760186dc070d3db190ca61efdbce23afc88 - Patch
References () https://git.kernel.org/stable/c/2871aa407007f6f531fae181ad252486e022df42 - () https://git.kernel.org/stable/c/2871aa407007f6f531fae181ad252486e022df42 - Patch
References () https://git.kernel.org/stable/c/4cb3cf7177ae3666be7fb27d4ad4d72a295fb02d - () https://git.kernel.org/stable/c/4cb3cf7177ae3666be7fb27d4ad4d72a295fb02d - Patch
References () https://git.kernel.org/stable/c/70154e8d015c9b4fb56c1a2ef1fc8b83d45c7f68 - () https://git.kernel.org/stable/c/70154e8d015c9b4fb56c1a2ef1fc8b83d45c7f68 - Patch
References () https://git.kernel.org/stable/c/ee5e7632e981673f42a50ade25e71e612e543d9d - () https://git.kernel.org/stable/c/ee5e7632e981673f42a50ade25e71e612e543d9d - Patch
References () https://git.kernel.org/stable/c/efa56305908ba20de2104f1b8508c6a7401833be - () https://git.kernel.org/stable/c/efa56305908ba20de2104f1b8508c6a7401833be - Patch
References () https://git.kernel.org/stable/c/f775f2621c2ac5cc3a0b3a64665dad4fb146e510 - () https://git.kernel.org/stable/c/f775f2621c2ac5cc3a0b3a64665dad4fb146e510 - Patch
CWE CWE-476
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: nvmet-tcp: soluciona un pánico del kernel cuando el host envía una longitud de PDU H2C no válida. Si el host envía un comando H2CData con un DATAL no válido, el kernel puede fallar en nvmet_tcp_build_pdu_iovec(). No se puede manejar la desreferencia del puntero NULL del kernel en la dirección virtual 0000000000000000 lr: nvmet_tcp_io_work+0x6ac/0x718 [nvmet_tcp] Rastreo de llamadas: Process_one_work+0x174/0x3c8 trabajador_thread+0x2d0/0x3e8 kthread+0x104/0x110 Solucione el error generando un error fatal si DATAL es No es coherente con el tamaño del paquete. Además, la longitud de la PDU nunca debe exceder el parámetro MAXH2CDATA que se ha comunicado al host en nvmet_tcp_handle_icreq().
First Time Linux linux Kernel
Linux

23 Feb 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-23 15:15

Updated : 2024-04-19 18:40

NVD link : CVE-2023-52454

Mitre link : CVE-2023-52454

CVE.ORG link : CVE-2023-52454

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference