CVE-2023-53510

In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: core: Fix handling of lrbp->cmd

ufshcd_queuecommand() may be called two times in a row for a SCSI command before it is completed. Hence make the following changes:

• In the functions that submit a command, do not check the old value of lrbp->cmd nor clear lrbp->cmd in error paths.

• In ufshcd_release_scsi_cmd(), do not clear lrbp->cmd.

See also scsi_send_eh_cmnd().

This commit prevents that the following appears if a command times out:

WARNING: at drivers/ufs/core/ufshcd.c:2965 ufshcd_queuecommand+0x6f8/0x9a8 Call trace: ufshcd_queuecommand+0x6f8/0x9a8 scsi_send_eh_cmnd+0x2c0/0x960 scsi_eh_test_devices+0x100/0x314 scsi_eh_ready_devs+0xd90/0x114c scsi_error_handler+0x2b4/0xb70 kthread+0x16c/0x1e0

A flaw of low impact was found in the Linux kernel Universal Flash Storage (UFS) SCSI driver. When a UFS SCSI command times out, the SCSI error handler may legitimately re-submit the same command through scsi_send_eh_cmnd() before the original command has completed. The UFS driver incorrectly treated the still-populated lrbp->cmd command pointer as an invalid condition in this situation, triggering a WARN_ON in ufshcd_queuecommand(). The demonstrated consequence is a non-fatal kernel warning and stack trace during SCSI error recovery; the fixing commit does not demonstrate memory corruption, use-after-free, out-of-bounds access, information disclosure, or privilege escalation. Triggering the warning requires a UFS command timeout that causes the SCSI error-recovery path to re-enter ufshcd_queuecommand(), which is reflected in the high attack complexity of the Red Hat score. Red Hat Enterprise Linux 9 (kernel and kernel-rt) is affected and the fix is deferred: because the issue is of low severity with consequences limited to a non-fatal kernel warning in the storage error-recovery path, it will be addressed in a future RHEL 9 update rather than an immediate erratum. The residual risk is limited to that warning during UFS command timeout handling; a more severe outcome such as a kernel panic would require an additional condition such as panic_on_warn being enabled, which is not an intrinsic consequence of this flaw. Red Hat Enterprise Linux 6, 7, 8, and 10, and Red Hat In-Vehicle OS, are marked not affected because the vulnerable code is not present in those streams. The Red Hat severity of Low (CVSS 3.1 score 2.5) differs from the upstream NIST and CVE.org score of 7.8 because the upstream scoring assumes high confidentiality, integrity, and availability impacts that are not established by the available evidence for this change.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.