CVE-2023-52785 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR If command timeout happens and cq complete IRQ is raised at the same time, ufshcd_mcq_abort clears lprb->cmd and a NULL pointer deref happens in the ISR. Error log: ufshcd_abort: Device abort task at tag 18 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000108 pc : [0xffffffe27ef867ac] scsi_dma_unmap+0xc/0x44 lr : [0xffffffe27f1b898c] ufshcd_release_scsi_cmd+0x24/0x114

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/27900d7119c464b43cd9eac69c85884d17bae240
https://git.kernel.org/stable/c/8f15a7e3c054d960bbd1521110700450bbf798a1
https://git.kernel.org/stable/c/f84d461f33a6b27304d468d9cfb56c0cefdb4ee7
https://lore.kernel.org/linux-cve-announce/2024052154-CVE-2023-52785-8104@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2023-52785
https://www.cve.org/CVERecord?id=CVE-2023-52785

History

Mon, 04 Nov 2024 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-05-21T15:31:03.040Z

Updated: 2024-11-04T14:52:41.606Z

Reserved: 2024-05-21T15:19:24.241Z

Link: CVE-2023-52785

Vulnrichment

Updated: 2024-08-02T23:11:36.024Z

NVD

Status : Awaiting Analysis

Published: 2024-05-21T16:15:17.330

Modified: 2024-05-21T16:53:56.550

Link: CVE-2023-52785

Redhat

Severity : Low

Publid Date: 2024-05-21T00:00:00Z

Links: CVE-2023-52785 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-52785", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-21T15:19:24.241Z", "datePublished": "2024-05-21T15:31:03.040Z", "dateUpdated": "2024-11-04T14:52:41.606Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T14:52:41.606Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR\n\nIf command timeout happens and cq complete IRQ is raised at the same time,\nufshcd_mcq_abort clears lprb->cmd and a NULL pointer deref happens in the\nISR. Error log:\n\nufshcd_abort: Device abort task at tag 18\nUnable to handle kernel NULL pointer dereference at virtual address\n0000000000000108\npc : [0xffffffe27ef867ac] scsi_dma_unmap+0xc/0x44\nlr : [0xffffffe27f1b898c] ufshcd_release_scsi_cmd+0x24/0x114"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/ufs/core/ufs-mcq.c"], "versions": [{"version": "f1304d442077", "lessThan": "8f15a7e3c054", "status": "affected", "versionType": "git"}, {"version": "f1304d442077", "lessThan": "f84d461f33a6", "status": "affected", "versionType": "git"}, {"version": "f1304d442077", "lessThan": "27900d7119c4", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/ufs/core/ufs-mcq.c"], "versions": [{"version": "6.5", "status": "affected"}, {"version": "0", "lessThan": "6.5", "status": "unaffected", "versionType": "semver"}, {"version": "6.5.13", "lessThanOrEqual": "6.5.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.3", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/8f15a7e3c054d960bbd1521110700450bbf798a1"}, {"url": "https://git.kernel.org/stable/c/f84d461f33a6b27304d468d9cfb56c0cefdb4ee7"}, {"url": "https://git.kernel.org/stable/c/27900d7119c464b43cd9eac69c85884d17bae240"}], "title": "scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-52785", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-21T18:33:28.174568Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:23:35.194Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:11:36.024Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/8f15a7e3c054d960bbd1521110700450bbf798a1", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f84d461f33a6b27304d468d9cfb56c0cefdb4ee7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/27900d7119c464b43cd9eac69c85884d17bae240", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/8f15a7e3c054d960bbd1521110700450bbf798a1", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f84d461f33a6b27304d468d9cfb56c0cefdb4ee7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/27900d7119c464b43cd9eac69c85884d17bae240", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:11:36.024Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-52785", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-21T18:33:28.174568Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:25.446Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "f1304d442077", "lessThan": "8f15a7e3c054", "versionType": "git"}, {"status": "affected", "version": "f1304d442077", "lessThan": "f84d461f33a6", "versionType": "git"}, {"status": "affected", "version": "f1304d442077", "lessThan": "27900d7119c4", "versionType": "git"}], "programFiles": ["drivers/ufs/core/ufs-mcq.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.5"}, {"status": "unaffected", "version": "0", "lessThan": "6.5", "versionType": "semver"}, {"status": "unaffected", "version": "6.5.13", "versionType": "semver", "lessThanOrEqual": "6.5.*"}, {"status": "unaffected", "version": "6.6.3", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/ufs/core/ufs-mcq.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/8f15a7e3c054d960bbd1521110700450bbf798a1"}, {"url": "https://git.kernel.org/stable/c/f84d461f33a6b27304d468d9cfb56c0cefdb4ee7"}, {"url": "https://git.kernel.org/stable/c/27900d7119c464b43cd9eac69c85884d17bae240"}], "x_generator": {"engine": "bippy-9e1c9544281a"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR\n\nIf command timeout happens and cq complete IRQ is raised at the same time,\nufshcd_mcq_abort clears lprb->cmd and a NULL pointer deref happens in the\nISR. Error log:\n\nufshcd_abort: Device abort task at tag 18\nUnable to handle kernel NULL pointer dereference at virtual address\n0000000000000108\npc : [0xffffffe27ef867ac] scsi_dma_unmap+0xc/0x44\nlr : [0xffffffe27f1b898c] ufshcd_release_scsi_cmd+0x24/0x114"}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T14:52:41.606Z"}}}, "cveMetadata": {"cveId": "CVE-2023-52785", "state": "PUBLISHED", "dateUpdated": "2024-11-04T14:52:41.606Z", "dateReserved": "2024-05-21T15:19:24.241Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-21T15:31:03.040Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"bugzilla": {"description": "kernel: scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR", "id": "2282651", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2282651"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-413", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nscsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR\nIf command timeout happens and cq complete IRQ is raised at the same time,\nufshcd_mcq_abort clears lprb->cmd and a NULL pointer deref happens in the\nISR. Error log:\nufshcd_abort: Device abort task at tag 18\nUnable to handle kernel NULL pointer dereference at virtual address\n0000000000000108\npc : [0xffffffe27ef867ac] scsi_dma_unmap+0xc/0x44\nlr : [0xffffffe27f1b898c] ufshcd_release_scsi_cmd+0x24/0x114"], "name": "CVE-2023-52785", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-52785\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-52785\nhttps://lore.kernel.org/linux-cve-announce/2024052154-CVE-2023-52785-8104@gregkh/T"], "threat_severity": "Low", "upstream_fix": "kernel 6.5.13, kernel 6.6.3, kernel 6.7"}