cve/published/2023/CVE-2023-53078.mbox

From bippy-1.1.0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@kernel.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2023-53078: scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate()

If alua_rtpg_queue() failed from alua_activate(), then 'qdata' is not
freed, which will cause following memleak:

unreferenced object 0xffff88810b2c6980 (size 32):
  comm "kworker/u16:2", pid 635322, jiffies 4355801099 (age 1216426.076s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    40 39 24 c1 ff ff ff ff 00 f8 ea 0a 81 88 ff ff  @9$.............
  backtrace:
    [<0000000098f3a26d>] alua_activate+0xb0/0x320
    [<000000003b529641>] scsi_dh_activate+0xb2/0x140
    [<000000007b296db3>] activate_path_work+0xc6/0xe0 [dm_multipath]
    [<000000007adc9ace>] process_one_work+0x3c5/0x730
    [<00000000c457a985>] worker_thread+0x93/0x650
    [<00000000cb80e628>] kthread+0x1ba/0x210
    [<00000000a1e61077>] ret_from_fork+0x22/0x30

Fix the problem by freeing 'qdata' in error path.

The Linux kernel CVE team has assigned CVE-2023-53078 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.11 with commit 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 and fixed in 4.14.312 with commit 123483df146492ca22b503ae6dacc2ce7c3a3974
	Issue introduced in 4.11 with commit 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 and fixed in 4.19.280 with commit c110051d335ef7f62ad33474b0c23997fee5bfb5
	Issue introduced in 4.11 with commit 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 and fixed in 5.4.240 with commit 5c4d71424df34fc23dc5336d09394ce68c849542
	Issue introduced in 4.11 with commit 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 and fixed in 5.10.177 with commit c09cdf6eb815ee35e55d6c50ac7f63db58bd20b8
	Issue introduced in 4.11 with commit 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 and fixed in 5.15.105 with commit 9311e7a554dffd3823499e309a8b86a5cd1540e5
	Issue introduced in 4.11 with commit 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 and fixed in 6.1.22 with commit 1c55982beb80c7d3c30278fc6cfda8496a31dbe6
	Issue introduced in 4.11 with commit 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 and fixed in 6.2.9 with commit 0d89254a4320eb7de0970c478172f764125c6355
	Issue introduced in 4.11 with commit 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 and fixed in 6.3 with commit a13faca032acbf2699293587085293bdfaafc8ae
	Issue introduced in 4.9.21 with commit 68b275b7cbf065a8ea9b964cbb7d78d2b63c635f
	Issue introduced in 4.10.9 with commit 2b1725d1df362499f6bbd5a7e245a4090b29c2bb

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-53078
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/scsi/device_handler/scsi_dh_alua.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/123483df146492ca22b503ae6dacc2ce7c3a3974
	https://git.kernel.org/stable/c/c110051d335ef7f62ad33474b0c23997fee5bfb5
	https://git.kernel.org/stable/c/5c4d71424df34fc23dc5336d09394ce68c849542
	https://git.kernel.org/stable/c/c09cdf6eb815ee35e55d6c50ac7f63db58bd20b8
	https://git.kernel.org/stable/c/9311e7a554dffd3823499e309a8b86a5cd1540e5
	https://git.kernel.org/stable/c/1c55982beb80c7d3c30278fc6cfda8496a31dbe6
	https://git.kernel.org/stable/c/0d89254a4320eb7de0970c478172f764125c6355
	https://git.kernel.org/stable/c/a13faca032acbf2699293587085293bdfaafc8ae