CVE-2023-52785 scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR
A race condition in the Linux kernel UFS driver can cause a NULL pointer dereference and system crash when command timeouts coincide with interrupt handling.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-52785?
CVE-2023-52785 is a medium-severity vulnerability in Linux kernel, published on 21 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR
If command timeout happens and cq complete IRQ is raised at the same time, ufshcd_mcq_abort clears lprb->cmd and a NULL pointer deref happens in the ISR. Error log:
ufshcd_abort: Device abort task at tag 18 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000108 pc : [0xffffffe27ef867ac] scsi_dma_unmap+0xc/0x44 lr : [0xffffffe27f1b898c] ufshcd_release_scsi_cmd+0x24/0x114
Weakness: CWE-362
Which versions are affected by CVE-2023-52785?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-52785?
Apply the vendor's patch.
Is CVE-2023-52785 being exploited?
There is no known exploitation of CVE-2023-52785 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2023-52785, DEBIAN-CVE-2023-52785, GHSA-7prj-h6r4-gh9j, UBUNTU-CVE-2023-52785.