CVE-2023-52811

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool

In practice the driver should never send more commands than are allocated

to a queue's event pool. In the unlikely event that this happens, the code

asserts a BUG_ON, and in the case that the kernel is not configured to

crash on panic returns a junk event pointer from the empty event list

causing things to spiral from there. This BUG_ON is a historical artifact

of the ibmvfc driver first being upstreamed, and it is well known now that

the use of BUG_ON is bad practice except in the most unrecoverable

scenario. There is nothing about this scenario that prevents the driver

from recovering and carrying on.

Remove the BUG_ON in question from ibmvfc_get_event() and return a NULL

pointer in the case of an empty event pool. Update all call sites to

ibmvfc_get_event() to check for a NULL pointer and perfrom the appropriate

failure or recovery action.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References