CVE-2023-52811
Description
In the Linux kernel, the following vulnerability has been resolved: scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool In practice the driver should never send more commands than are allocated to a queue's event pool. In the unlikely event that this happens, the code asserts a BUG_ON, and in the case that the kernel is not configured to crash on panic returns a junk event pointer from the empty event list causing things to spiral from there. This BUG_ON is a historical artifact of the ibmvfc driver first being upstreamed, and it is well known now that the use of BUG_ON is bad practice except in the most unrecoverable scenario. There is nothing about this scenario that prevents the driver from recovering and carrying on. Remove the BUG_ON in question from ibmvfc_get_event() and return a NULL pointer in the case of an empty event pool. Update all call sites to ibmvfc_get_event() to check for a NULL pointer and perfrom the appropriate failure or recovery action.
How to fix
- linux linux_kernel5.15.140, 6.1.64, 6.5.13, 6.6.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | v < 5.15.140, 5.16 ≤ v < 6.1.64, 6.2 ≤ v < 6.5.13, 6.6 ≤ v < 6.6.3 | 5.15.140, 6.1.64, 6.5.13, 6.6.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.