CVE-2023-53320

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info()

The function mpi3mr_get_all_tgt_info() has four issues:

1) It calculates valid entry length in alltgt_info assuming the header part

of the struct mpi3mr_device_map_info would equal to sizeof(u32). The

correct size is sizeof(u64).

2) When it calculates the valid entry length kern_entrylen, it excludes one

entry by subtracting 1 from num_devices.

3) It copies num_device by calling memcpy(). Substitution is enough.

4) It does not specify the calculated length to sg_copy_from_buffer().

Instead, it specifies the payload length which is larger than the

alltgt_info size. It causes "BUG: KASAN: slab-out-of-bounds".

Fix the issues by using the correct header size, removing the subtraction

from num_devices, replacing the memcpy() with substitution and specifying

the correct length to sg_copy_from_buffer().

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References