CVE-2023-53245

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: storvsc: Fix handling of virtual Fibre Channel timeouts

Hyper-V provides the ability to connect Fibre Channel LUNs to the host

system and present them in a guest VM as a SCSI device. I/O to the vFC

device is handled by the storvsc driver. The storvsc driver includes a

partial integration with the FC transport implemented in the generic

portion of the Linux SCSI subsystem so that FC attributes can be displayed

in /sys. However, the partial integration means that some aspects of vFC

don't work properly. Unfortunately, a full and correct integration isn't

practical because of limitations in what Hyper-V provides to the guest.

In particular, in the context of Hyper-V storvsc, the FC transport timeout

function fc_eh_timed_out() causes a kernel panic because it can't find the

rport and dereferences a NULL pointer. The original patch that added the

call from storvsc_eh_timed_out() to fc_eh_timed_out() is faulty in t

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References