CVE-2023-52974
Published: Mar 27, 2025
Modified: May 11, 2026
Description
In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress If during iscsi_sw_tcp_session_create() iscsi_tcp_r2tpool_alloc() fails, userspace could be accessing the host's ipaddress attr. If we then free the session via iscsi_session_teardown() while userspace is still accessing the session we will hit a use after free bug. Set the tcp_sw_host->session after we have completed session creation and can no longer fail.
| Vendor | Product | Versions |
|---|---|---|
Linux | Linux | affected a79af8a64d395bd89de8695a5ea5e1a7f01f02a8 - < 496af9d3682ed4c28fb734342a09e6cc0c056ea4affected a79af8a64d395bd89de8695a5ea5e1a7f01f02a8 - < 6abd4698f4c8a78e7bbfc421205c060c199554a0affected a79af8a64d395bd89de8695a5ea5e1a7f01f02a8 - < d4d765f4761f9e3a2d62992f825aeee593bcb6b9affected a79af8a64d395bd89de8695a5ea5e1a7f01f02a8 - < 9758ffe1c07b86aefd7ca8e40d9a461293427ca0affected a79af8a64d395bd89de8695a5ea5e1a7f01f02a8 - < 0aaabdb900c7415caa2006ef580322f7eac5f6b6+2 more versions |
Linux | Linux | affected 2.6.39unaffected 0 - < 2.6.39unaffected 4.14.306 - <= 4.14.*unaffected 4.19.273 - <= 4.19.*unaffected 5.4.232 - <= 5.4.*+4 more versions |
References
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now