CVE-2023-52974
scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress If during iscsi_sw_tcp_session_create() iscsi_tcp_r2tpool_alloc() fails,
userspace could be accessing the host's ipaddress attr. If we then free the
session via iscsi_session_teardown() while userspace is still accessing the
session we will hit a use after free bug. Set the tcp_sw_host->session after we have completed session creation and
can no longer fail.
A vulnerability was found in the Linux kernel's iscsi tcp drivers. Improper resource allocation management can lead to a use-after-free scenario, triggered when the userspace attempts to access the session host's `ipaddress` attribute while the kernel is performing a session teardown via `iscsi_session_teardown()`.
In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress If during iscsi_sw_tcp_session_create() iscsi_tcp_r2tpool_alloc() fails, userspace could be accessing the host's ipaddress attr. If we then free the session via iscsi_session_teardown() while userspace is still accessing the session we will hit a use after free bug. Set the tcp_sw_host->session after we have completed session creation and can no longer fail.
The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes. The following security bugs were fixed.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2025-03-27 CVE Reserved
- 2025-03-27 CVE Published
- 2026-05-06 EPSS Updated
- 2026-05-11 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-416: Use After Free
CAPEC
References (10)
| URL | Tag | Source |
|---|---|---|
| https://git.kernel.org/stable/c/a79af8a64d395bd89de8695a5ea5e1a7f01f02a8 | Vuln. Introduced |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2023-52974 | 2024-01-30 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2355469 | 2024-01-30 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 2.6.39 < 4.14.306 Search vendor "Linux" for product "Linux Kernel" and version " >= 2.6.39 < 4.14.306" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 2.6.39 < 4.19.273 Search vendor "Linux" for product "Linux Kernel" and version " >= 2.6.39 < 4.19.273" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 2.6.39 < 5.4.232 Search vendor "Linux" for product "Linux Kernel" and version " >= 2.6.39 < 5.4.232" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 2.6.39 < 5.10.168 Search vendor "Linux" for product "Linux Kernel" and version " >= 2.6.39 < 5.10.168" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 2.6.39 < 5.15.93 Search vendor "Linux" for product "Linux Kernel" and version " >= 2.6.39 < 5.15.93" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 2.6.39 < 6.1.11 Search vendor "Linux" for product "Linux Kernel" and version " >= 2.6.39 < 6.1.11" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 2.6.39 < 6.2 Search vendor "Linux" for product "Linux Kernel" and version " >= 2.6.39 < 6.2" | en |
Affected
| ||||||