ghsa-7prj-h6r4-gh9j
Vulnerability from github
Published
2024-05-21 18:31
Modified
2024-05-21 18:31
Details
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR
If command timeout happens and cq complete IRQ is raised at the same time, ufshcd_mcq_abort clears lprb->cmd and a NULL pointer deref happens in the ISR. Error log:
ufshcd_abort: Device abort task at tag 18 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000108 pc : [0xffffffe27ef867ac] scsi_dma_unmap+0xc/0x44 lr : [0xffffffe27f1b898c] ufshcd_release_scsi_cmd+0x24/0x114
{
"affected": [],
"aliases": [
"CVE-2023-52785"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T16:15:17Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR\n\nIf command timeout happens and cq complete IRQ is raised at the same time,\nufshcd_mcq_abort clears lprb-\u003ecmd and a NULL pointer deref happens in the\nISR. Error log:\n\nufshcd_abort: Device abort task at tag 18\nUnable to handle kernel NULL pointer dereference at virtual address\n0000000000000108\npc : [0xffffffe27ef867ac] scsi_dma_unmap+0xc/0x44\nlr : [0xffffffe27f1b898c] ufshcd_release_scsi_cmd+0x24/0x114",
"id": "GHSA-7prj-h6r4-gh9j",
"modified": "2024-05-21T18:31:21Z",
"published": "2024-05-21T18:31:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52785"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/27900d7119c464b43cd9eac69c85884d17bae240"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8f15a7e3c054d960bbd1521110700450bbf798a1"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f84d461f33a6b27304d468d9cfb56c0cefdb4ee7"
}
],
"schema_version": "1.4.0",
"severity": []
}
Loading...