CVE-2023-52500 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command Tags allocated for OPC_INB_SET_CONTROLLER_CONFIG command need to be freed when we receive the response.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/2259e1901b2d8c0e8538fc99e77de443b939e749
https://git.kernel.org/stable/c/22e6d783a33015bcdf0979015e4eac603912bea7
https://git.kernel.org/stable/c/2afd8fcee0c4d65a482e30c3ad2a92c25e5e92d4
https://git.kernel.org/stable/c/c13e7331745852d0dd7c35eabbe181cbd5b01172
https://git.kernel.org/stable/c/d540a4370aba378fbedf349ba0bb68e96e24243d
https://lore.kernel.org/linux-cve-announce/2024030248-CVE-2023-52500-3d53@gregkh/T/#u
https://nvd.nist.gov/vuln/detail/CVE-2023-52500
https://www.cve.org/CVERecord?id=CVE-2023-52500

History

No history.

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-03-02T21:52:15.903Z

Updated: 2024-11-04T14:48:04.039Z

Reserved: 2024-02-20T12:30:33.313Z

Link: CVE-2023-52500

Vulnrichment

Updated: 2024-08-02T23:03:19.955Z

NVD

Status : Awaiting Analysis

Published: 2024-03-02T22:15:47.103

Modified: 2024-03-04T13:58:23.447

Link: CVE-2023-52500

Redhat

Severity : Low

Publid Date: 2024-03-02T00:00:00Z

Links: CVE-2023-52500 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-52500", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-20T12:30:33.313Z", "datePublished": "2024-03-02T21:52:15.903Z", "dateUpdated": "2024-11-04T14:48:04.039Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T14:48:04.039Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command\n\nTags allocated for OPC_INB_SET_CONTROLLER_CONFIG command need to be freed\nwhen we receive the response."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/scsi/pm8001/pm80xx_hwi.c"], "versions": [{"version": "1da177e4c3f4", "lessThan": "2afd8fcee0c4", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "d540a4370aba", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "2259e1901b2d", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "22e6d783a330", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "c13e73317458", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/scsi/pm8001/pm80xx_hwi.c"], "versions": [{"version": "5.10.198", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.134", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.56", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.5.6", "lessThanOrEqual": "6.5.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/2afd8fcee0c4d65a482e30c3ad2a92c25e5e92d4"}, {"url": "https://git.kernel.org/stable/c/d540a4370aba378fbedf349ba0bb68e96e24243d"}, {"url": "https://git.kernel.org/stable/c/2259e1901b2d8c0e8538fc99e77de443b939e749"}, {"url": "https://git.kernel.org/stable/c/22e6d783a33015bcdf0979015e4eac603912bea7"}, {"url": "https://git.kernel.org/stable/c/c13e7331745852d0dd7c35eabbe181cbd5b01172"}], "title": "scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-52500", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-07T16:04:17.175874Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:23:57.406Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:03:19.955Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/2afd8fcee0c4d65a482e30c3ad2a92c25e5e92d4", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d540a4370aba378fbedf349ba0bb68e96e24243d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2259e1901b2d8c0e8538fc99e77de443b939e749", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/22e6d783a33015bcdf0979015e4eac603912bea7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c13e7331745852d0dd7c35eabbe181cbd5b01172", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/2afd8fcee0c4d65a482e30c3ad2a92c25e5e92d4", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d540a4370aba378fbedf349ba0bb68e96e24243d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2259e1901b2d8c0e8538fc99e77de443b939e749", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/22e6d783a33015bcdf0979015e4eac603912bea7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c13e7331745852d0dd7c35eabbe181cbd5b01172", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:03:19.955Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-52500", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-07T16:04:17.175874Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:16.317Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1da177e4c3f4", "lessThan": "2afd8fcee0c4", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "d540a4370aba", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "2259e1901b2d", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "22e6d783a330", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "c13e73317458", "versionType": "git"}], "programFiles": ["drivers/scsi/pm8001/pm80xx_hwi.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "unaffected", "version": "5.10.198", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.134", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.56", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.5.6", "versionType": "semver", "lessThanOrEqual": "6.5.*"}, {"status": "unaffected", "version": "6.6", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/scsi/pm8001/pm80xx_hwi.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/2afd8fcee0c4d65a482e30c3ad2a92c25e5e92d4"}, {"url": "https://git.kernel.org/stable/c/d540a4370aba378fbedf349ba0bb68e96e24243d"}, {"url": "https://git.kernel.org/stable/c/2259e1901b2d8c0e8538fc99e77de443b939e749"}, {"url": "https://git.kernel.org/stable/c/22e6d783a33015bcdf0979015e4eac603912bea7"}, {"url": "https://git.kernel.org/stable/c/c13e7331745852d0dd7c35eabbe181cbd5b01172"}], "x_generator": {"engine": "bippy-9e1c9544281a"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command\n\nTags allocated for OPC_INB_SET_CONTROLLER_CONFIG command need to be freed\nwhen we receive the response."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T14:48:04.039Z"}}}, "cveMetadata": {"cveId": "CVE-2023-52500", "state": "PUBLISHED", "dateUpdated": "2024-11-04T14:48:04.039Z", "dateReserved": "2024-02-20T12:30:33.313Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-03-02T21:52:15.903Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}