CVE-2023-53586
Description
A race condition flaw was found in the Linux kernel SCSI target subsystem's LUN_RESET handling. When multiple remote initiator sessions send concurrent LUN_RESET commands, one session's reset can incorrectly drain commands from another session, causing the second session to receive a successful reset response even though its commands weren't cleaned up, which results in the initiator reissuing commands while the old ones are still executing and leads to command confusion and potential data integrity issues.
Statement
The issue arises because LUN_RESET operations from different sessions aren't properly serialized. When session1's LUN_RESET begins processing, it moves all running commands (from both sessions) to its local drain_task_list. Meanwhile, session2's LUN_RESET doesn't see session1's reset operation (because it removed itself from the TMR list) and doesn't see any commands (because session1 moved them). Session2 then incorrectly reports success to its initiator. The initiator believes its commands are aborted and reissues them, but the backend eventually completes the original commands, returning aborted task statuses. The initiator then encounters invalid ITT errors or accidentally looks up reused ITTs. This can cause I/O errors and potential data corruption if reissued commands overlap with still-executing original commands. The race requires precise timing between multiple sessions sending LUN_RESET commands concurrently.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.1 | 4.7 | 8.8 |
| Attack Vector | Local | Local | Network |
| Attack Complexity | High | High | Low |
| Privileges Required | None | Low | Low |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | None | High |
| Integrity Impact | None | None | High |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Integrity,Confidentiality,Other
Technical Impact: Modify Application Data; Read Application Data; Alter Execution Logic
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
