CVE-2023-52974

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress

If during iscsi_sw_tcp_session_create() iscsi_tcp_r2tpool_alloc() fails, userspace could be accessing the host's ipaddress attr. If we then free the session via iscsi_session_teardown() while userspace is still accessing the session we will hit a use after free bug.

Set the tcp_sw_host->session after we have completed session creation and can no longer fail.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
LinuxLinux>= a79af8a64d395bd89de8695a5ea5e1a7f01f02a8, < 496af9d3682ed4c28fb734342a09e6cc0c056ea4; >= a79af8a64d395bd89de8695a5ea5e1a7f01f02a8, < 6abd4698f4c8a78e7bbfc421205c060c199554a0; >= a79af8a64d395bd89de8695a5ea5e1a7f01f02a8, < d4d765f4761f9e3a2d62992f825aeee593bcb6b9; >= a79af8a64d395bd89de8695a5ea5e1a7f01f02a8, < 9758ffe1c07b86aefd7ca8e40d9a461293427ca0; >= a79af8a64d395bd89de8695a5ea5e1a7f01f02a8, < 0aaabdb900c7415caa2006ef580322f7eac5f6b6; >= a79af8a64d395bd89de8695a5ea5e1a7f01f02a8, < 61e43ebfd243bcbad11be26bd921723027b77441; >= a79af8a64d395bd89de8695a5ea5e1a7f01f02a8, < f484a794e4ee2a9ce61f52a78e810ac45f3fe3b3
LinuxLinux2.6.39

References

Timeline

Published
Mar 27, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2023

CVE-2023-529757.8In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddreCVE-2023-529765.5In the Linux kernel, the following vulnerability has been resolved: efi: fix potential NULL deref in efi_mem_reserve_persistent When iteraCVE-2023-529775.5In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix flow memory leak in ovs_flow_cmd_new Syzkaller rCVE-2023-529785.5In the Linux kernel, the following vulnerability has been resolved: riscv: kprobe: Fixup kernel panic when probing an illegal position TheCVE-2023-52987.5A vulnerability was found in Tongda OA 2017. It has been rated as critical. Affected by this issue is some unknown functionality of the fileCVE-2023-529807.8In the Linux kernel, the following vulnerability has been resolved: block: ublk: extending queue_size to fix overflow When validating drafCVE-2023-529815.5In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix request ref counting during error capture & debugfs dump CVE-2023-529825.5In the Linux kernel, the following vulnerability has been resolved: fscache: Use wait_on_bit() to wait for the freeing of relinquished voluCVE-2023-529837.8In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix uaf for bfqq in bic_set_bfqq() After commit 64dc8c732fCVE-2023-529845.5In the Linux kernel, the following vulnerability has been resolved: net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices CVE-2023-529855.5In the Linux kernel, the following vulnerability has been resolved: arm64: dts: imx8mm-verdin: Do not power down eth-phy Currently if suspCVE-2023-529865.5In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener A