linux-cve-announce - CVE-2023-53140: scsi: core: Remove the /proc/scsi/${proc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025050238-CVE-2023-53140-a5f2@gregkh>
Date: Fri,  2 May 2025 17:56:45 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-53140: scsi: core: Remove the /proc/scsi/${proc_name} directory earlier

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

scsi: core: Remove the /proc/scsi/${proc_name} directory earlier

Remove the /proc/scsi/${proc_name} directory earlier to fix a race
condition between unloading and reloading kernel modules. This fixes a bug
introduced in 2009 by commit 77c019768f06 ("[SCSI] fix /proc memory leak in
the SCSI core").

Fix the following kernel warning:

proc_dir_entry 'scsi/scsi_debug' already registered
WARNING: CPU: 19 PID: 27986 at fs/proc/generic.c:376 proc_register+0x27d/0x2e0
Call Trace:
 proc_mkdir+0xb5/0xe0
 scsi_proc_hostdir_add+0xb5/0x170
 scsi_host_alloc+0x683/0x6c0
 sdebug_driver_probe+0x6b/0x2d0 [scsi_debug]
 really_probe+0x159/0x540
 __driver_probe_device+0xdc/0x230
 driver_probe_device+0x4f/0x120
 __device_attach_driver+0xef/0x180
 bus_for_each_drv+0xe5/0x130
 __device_attach+0x127/0x290
 device_initial_probe+0x17/0x20
 bus_probe_device+0x110/0x130
 device_add+0x673/0xc80
 device_register+0x1e/0x30
 sdebug_add_host_helper+0x1a7/0x3b0 [scsi_debug]
 scsi_debug_init+0x64f/0x1000 [scsi_debug]
 do_one_initcall+0xd7/0x470
 do_init_module+0xe7/0x330
 load_module+0x122a/0x12c0
 __do_sys_finit_module+0x124/0x1a0
 __x64_sys_finit_module+0x46/0x50
 do_syscall_64+0x38/0x80
 entry_SYSCALL_64_after_hwframe+0x46/0xb0

The Linux kernel CVE team has assigned CVE-2023-53140 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.30 with commit 77c019768f0607c36e25bec11ce3e1eabef09277 and fixed in 4.19.278 with commit 13daafe1e209b03e9bda16ff2bd2b2da145a139b
	Issue introduced in 2.6.30 with commit 77c019768f0607c36e25bec11ce3e1eabef09277 and fixed in 5.4.237 with commit 891a3cba425cf483d96facca55aebd6ff1da4338
	Issue introduced in 2.6.30 with commit 77c019768f0607c36e25bec11ce3e1eabef09277 and fixed in 5.10.175 with commit 6b223e32d66ca9db1f252f433514783d8b22a8e1
	Issue introduced in 2.6.30 with commit 77c019768f0607c36e25bec11ce3e1eabef09277 and fixed in 5.15.103 with commit e471e928de97b00f297ad1015cc14f9459765713
	Issue introduced in 2.6.30 with commit 77c019768f0607c36e25bec11ce3e1eabef09277 and fixed in 6.1.20 with commit 17e98a5ede81b7696bec421f7afa2dfe467f5e6b
	Issue introduced in 2.6.30 with commit 77c019768f0607c36e25bec11ce3e1eabef09277 and fixed in 6.2.7 with commit 1ec363599f8346d5a8d08c71a0d9860d6c420ec0
	Issue introduced in 2.6.30 with commit 77c019768f0607c36e25bec11ce3e1eabef09277 and fixed in 6.3 with commit fc663711b94468f4e1427ebe289c9f05669699c9

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-53140
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/scsi/hosts.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/13daafe1e209b03e9bda16ff2bd2b2da145a139b
	https://git.kernel.org/stable/c/891a3cba425cf483d96facca55aebd6ff1da4338
	https://git.kernel.org/stable/c/6b223e32d66ca9db1f252f433514783d8b22a8e1
	https://git.kernel.org/stable/c/e471e928de97b00f297ad1015cc14f9459765713
	https://git.kernel.org/stable/c/17e98a5ede81b7696bec421f7afa2dfe467f5e6b
	https://git.kernel.org/stable/c/1ec363599f8346d5a8d08c71a0d9860d6c420ec0
	https://git.kernel.org/stable/c/fc663711b94468f4e1427ebe289c9f05669699c9