linux-cve-announce - CVE-2023-53586: scsi: target: Fix multiple LUN

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025100425-CVE-2023-53586-67e1@gregkh>
Date: Sat,  4 Oct 2025 17:51:40 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-53586: scsi: target: Fix multiple LUN_RESET handling

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: Fix multiple LUN_RESET handling

This fixes a bug where an initiator thinks a LUN_RESET has cleaned up
running commands when it hasn't. The bug was added in commit 51ec502a3266
("target: Delete tmr from list before processing").

The problem occurs when:

 1. We have N I/O cmds running in the target layer spread over 2 sessions.

 2. The initiator sends a LUN_RESET for each session.

 3. session1's LUN_RESET loops over all the running commands from both
    sessions and moves them to its local drain_task_list.

 4. session2's LUN_RESET does not see the LUN_RESET from session1 because
    the commit above has it remove itself. session2 also does not see any
    commands since the other reset moved them off the state lists.

 5. sessions2's LUN_RESET will then complete with a successful response.

 6. sessions2's inititor believes the running commands on its session are
    now cleaned up due to the successful response and cleans up the running
    commands from its side. It then restarts them.

 7. The commands do eventually complete on the backend and the target
    starts to return aborted task statuses for them. The initiator will
    either throw a invalid ITT error or might accidentally lookup a new
    task if the ITT has been reallocated already.

Fix the bug by reverting the patch, and serialize the execution of
LUN_RESETs and Preempt and Aborts.

Also prevent us from waiting on LUN_RESETs in core_tmr_drain_tmr_list,
because it turns out the original patch fixed a bug that was not
mentioned. For LUN_RESET1 core_tmr_drain_tmr_list can see a second
LUN_RESET and wait on it. Then the second reset will run
core_tmr_drain_tmr_list and see the first reset and wait on it resulting in
a deadlock.

The Linux kernel CVE team has assigned CVE-2023-53586 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.11 with commit 51ec502a32665fed66c7f03799ede4023b212536 and fixed in 5.10.180 with commit e1f59cd18a10969d08a082264b557876ca38766e
	Issue introduced in 4.11 with commit 51ec502a32665fed66c7f03799ede4023b212536 and fixed in 5.15.111 with commit 9158c86fd3237acaea8f0181c7836d90fd6eea10
	Issue introduced in 4.11 with commit 51ec502a32665fed66c7f03799ede4023b212536 and fixed in 6.1.28 with commit eacfe32c3650bfd0e54224d160c431013d7f6998
	Issue introduced in 4.11 with commit 51ec502a32665fed66c7f03799ede4023b212536 and fixed in 6.2.15 with commit ed18526289b5603bf2253dee50f1d7ec245cf397
	Issue introduced in 4.11 with commit 51ec502a32665fed66c7f03799ede4023b212536 and fixed in 6.3.2 with commit 2c43de56f9220dca3e28c774d1c5e2cab574223a
	Issue introduced in 4.11 with commit 51ec502a32665fed66c7f03799ede4023b212536 and fixed in 6.4 with commit 673db054d7a2b5a470d7a25baf65956d005ad729

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-53586
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/target/target_core_device.c
	drivers/target/target_core_tmr.c
	include/target/target_core_base.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/e1f59cd18a10969d08a082264b557876ca38766e
	https://git.kernel.org/stable/c/9158c86fd3237acaea8f0181c7836d90fd6eea10
	https://git.kernel.org/stable/c/eacfe32c3650bfd0e54224d160c431013d7f6998
	https://git.kernel.org/stable/c/ed18526289b5603bf2253dee50f1d7ec245cf397
	https://git.kernel.org/stable/c/2c43de56f9220dca3e28c774d1c5e2cab574223a
	https://git.kernel.org/stable/c/673db054d7a2b5a470d7a25baf65956d005ad729