发布于3月6日3月6日 Members Red Hat: CVE-2023-52811: kernel: scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool (Multiple Advisories) Severity 5 CVSS (AV:L/AC:L/Au:S/C:N/I:N/A:C) Published 05/21/2024 Created 07/26/2024 Added 07/25/2024 Modified 02/10/2025 Description In the Linux kernel, the following vulnerability has been resolved: scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool In practice the driver should never send more commands than are allocated to a queue's event pool. In the unlikely event that this happens, the code asserts a BUG_ON, and in the case that the kernel is not configured to crash on panic returns a junk event pointer from the empty event list causing things to spiral from there. This BUG_ON is a historical artifact of the ibmvfc driver first being upstreamed, and it is well known now that the use of BUG_ON is bad practice except in the most unrecoverable scenario. There is nothing about this scenario that prevents the driver from recovering and carrying on. Remove the BUG_ON in question from ibmvfc_get_event() and return a NULL pointer in the case of an empty event pool. Update all call sites to ibmvfc_get_event() to check for a NULL pointer and perfrom the appropriate failure or recovery action. Solution(s) redhat-upgrade-kernel redhat-upgrade-kernel-rt References CVE-2023-52811 RHSA-2024:10771 RHSA-2024:4823 RHSA-2024:4831 RHSA-2024:5101 RHSA-2024:5102 RHSA-2024:6993 RHSA-2024:9315 View more
