linux-cve-announce - CVE-2025-38399: scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025072510-CVE-2025-38399-00ec@gregkh>
Date: Fri, 25 Jul 2025 14:55:30 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-38399: scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()

The function core_scsi3_decode_spec_i_port(), in its error code path,
unconditionally calls core_scsi3_lunacl_undepend_item() passing the
dest_se_deve pointer, which may be NULL.

This can lead to a NULL pointer dereference if dest_se_deve remains
unset.

SPC-3 PR SPEC_I_PT: Unable to locate dest_tpg
Unable to handle kernel paging request at virtual address dfff800000000012
Call trace:
  core_scsi3_lunacl_undepend_item+0x2c/0xf0 [target_core_mod] (P)
  core_scsi3_decode_spec_i_port+0x120c/0x1c30 [target_core_mod]
  core_scsi3_emulate_pro_register+0x6b8/0xcd8 [target_core_mod]
  target_scsi3_emulate_pr_out+0x56c/0x840 [target_core_mod]

Fix this by adding a NULL check before calling
core_scsi3_lunacl_undepend_item()

The Linux kernel CVE team has assigned CVE-2025-38399 to this issue.


Affected and fixed versions
===========================

	Fixed in 5.10.240 with commit 70ddb8133fdb512d4b1f2b4fd1c9e518514f182c
	Fixed in 5.15.187 with commit 1129e0e0a833acf90429e0f13951068d5f026e4f
	Fixed in 6.1.144 with commit 1627dda4d70ceb1ba62af2e401af73c09abb1eb5
	Fixed in 6.6.97 with commit 55dfffc5e94730370b08de02c0cf3b7c951bbe9e
	Fixed in 6.12.37 with commit 7296c938df2445f342be456a6ff0b3931d97f4e5
	Fixed in 6.15.6 with commit c412185d557578d3f936537ed639c4ffaaed4075
	Fixed in 6.16-rc3 with commit d8ab68bdb294b09a761e967dad374f2965e1913f

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-38399
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/target/target_core_pr.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/70ddb8133fdb512d4b1f2b4fd1c9e518514f182c
	https://git.kernel.org/stable/c/1129e0e0a833acf90429e0f13951068d5f026e4f
	https://git.kernel.org/stable/c/1627dda4d70ceb1ba62af2e401af73c09abb1eb5
	https://git.kernel.org/stable/c/55dfffc5e94730370b08de02c0cf3b7c951bbe9e
	https://git.kernel.org/stable/c/7296c938df2445f342be456a6ff0b3931d97f4e5
	https://git.kernel.org/stable/c/c412185d557578d3f936537ed639c4ffaaed4075
	https://git.kernel.org/stable/c/d8ab68bdb294b09a761e967dad374f2965e1913f