CVE-2023-53078

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate()

If alua_rtpg_queue() failed from alua_activate(), then 'qdata' is not

freed, which will cause following memleak:

unreferenced object 0xffff88810b2c6980 (size 32):

comm "kworker/u16:2", pid 635322, jiffies 4355801099 (age 1216426.076s)

hex dump (first 32 bytes):

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

40 39 24 c1 ff ff ff ff 00 f8 ea 0a 81 88 ff ff @9$.............

backtrace:

[<0000000098f3a26d>] alua_activate+0xb0/0x320

[<000000003b529641>] scsi_dh_activate+0xb2/0x140

[<000000007b296db3>] activate_path_work+0xc6/0xe0 [dm_multipath]

[<000000007adc9ace>] process_one_work+0x3c5/0x730

[<00000000c457a985>] worker_thread+0x93/0x650

[<00000000cb80e628>] kthread+0x1ba/0x210

[<00000000a1e61077>] ret_from_fork+0x22/0x30

Fix the problem by freeing 'qdata' in error path.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References