ghsa-mhc4-7fcr-wrj3
Vulnerability from github
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: iscsit: Free cmds before session free
Commands from recovery entries are freed after session has been closed. That leads to use-after-free at command free or NPE with such call trace:
Time2Retain timer expired for SID: 1, cleaning up iSCSI session. BUG: kernel NULL pointer dereference, address: 0000000000000140 RIP: 0010:sbitmap_queue_clear+0x3a/0xa0 Call Trace: target_release_cmd_kref+0xd1/0x1f0 [target_core_mod] transport_generic_free_cmd+0xd1/0x180 [target_core_mod] iscsit_free_cmd+0x53/0xd0 [iscsi_target_mod] iscsit_free_connection_recovery_entries+0x29d/0x320 [iscsi_target_mod] iscsit_close_session+0x13a/0x140 [iscsi_target_mod] iscsit_check_post_dataout+0x440/0x440 [iscsi_target_mod] call_timer_fn+0x24/0x140
Move cleanup of recovery enrties to before session freeing.
{
"affected": [],
"aliases": [
"CVE-2023-54184"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-30T13:16:06Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsit: Free cmds before session free\n\nCommands from recovery entries are freed after session has been closed.\nThat leads to use-after-free at command free or NPE with such call trace:\n\nTime2Retain timer expired for SID: 1, cleaning up iSCSI session.\nBUG: kernel NULL pointer dereference, address: 0000000000000140\nRIP: 0010:sbitmap_queue_clear+0x3a/0xa0\nCall Trace:\n target_release_cmd_kref+0xd1/0x1f0 [target_core_mod]\n transport_generic_free_cmd+0xd1/0x180 [target_core_mod]\n iscsit_free_cmd+0x53/0xd0 [iscsi_target_mod]\n iscsit_free_connection_recovery_entries+0x29d/0x320 [iscsi_target_mod]\n iscsit_close_session+0x13a/0x140 [iscsi_target_mod]\n iscsit_check_post_dataout+0x440/0x440 [iscsi_target_mod]\n call_timer_fn+0x24/0x140\n\nMove cleanup of recovery enrties to before session freeing.",
"id": "GHSA-mhc4-7fcr-wrj3",
"modified": "2025-12-30T15:30:30Z",
"published": "2025-12-30T15:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-54184"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1911cca5916b6e106de7afa3ec0a38447158216c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4621e24c9257c6379343bf0c11b473817cf7edcd"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4ce221d295f53e6c6b835ab33181e735482c9aac"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/89f5055f9b0b57c7e7f02e32df95ef401f809b71"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a7a4def6c7046e090bb10c6d550fdeb487db98ba"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d8990b5a4d065f38f35d69bcd627ec5a7f8330ca"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.