Executive brief
The Linux kernel's SCSI subsystem had a use-after-free vulnerability in the request queue handling code that could trigger a kernel panic. When processing storage device I/O requests, the code was attempting to access a device object after it had been freed, causing the system to crash. This impacts system stability for any Linux system with SCSI devices.
Technical details
The vulnerability is a use-after-free (CWE-416) in the SCSI core layer's request queuing mechanism. The problematic code in scsi_queue_rq() was attempting to increment an atomic counter (iorequest_cnt) on a device object after scsi_dispatch_cmd() had returned, but the device could have been freed by that point. The fix moves the atomic increment to occur earlier in scsi_dispatch_cmd() before the device state can change, eliminating the access to freed memory. This is a local/kernel-level vulnerability affecting any system using SCSI devices, and the patch is available in Linux kernel stable branches.
Affected products
- Linux Linux kernel multiple versions (patch available in stable branches)
Timeline
- 2023-05-16: disclosed
- 2023-05-24: patched