CVE-2023-53116
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
In the Linux kernel, the NVMe target subsystem (nvmet) has a use-after-free (UAF) vulnerability in nvmet_req_complete(). The queue_response() operation implementation may free the request passed as an argument, and then percpu_ref_put() may dereference the freed pointer. The fix saves the sq pointer in a local variable before calling __nvmet_req_complete() to avoid dereferencing the freed pointer.
Risk Assessment
The vulnerability could lead to system crashes or potentially privilege escalation in environments running an NVMe target, compromising service integrity and availability.
Recommendation
Apply the Linux kernel update containing the fix for CVE-2023-53116. Monitor for available patches and deploy them in production systems.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid potential UAF in nvmet_req_complete() An nvme target ->queue_response() operation implementation may free the request passed as argument. Such implementation potentially could result in a use after free of the request pointer when percpu_ref_put() is called in nvmet_req_complete(). Avoid such problem by using a local variable to save the sq pointer before calling __nvmet_req_complete(), thus avoiding dereferencing the req pointer after that function call.