Linux kernel (drivers/infiniband/ulp/srp): The SRP abort handler completes the SCSI command itself, after which the

CVSS 9.8CVE-2023-52515Firmware, BMC & network fabriccurated

Impact

The SRP abort handler completes the SCSI command itself, after which the SCSI error handler re-queues or re-finishes the same command - a use-after-free of the command structure. This fires on any aborted SRP command, so a storage timeout caused by fabric congestion (including congestion a noisy tenant creates) corrupts kernel memory on the node that mounts the SRP storage.

Who can reach it

Triggered on the initiator side by any SCSI abort, which means an ordinary command timeout - not only a hostile target. In a shared cluster a tenant that saturates the RDMA fabric can induce those timeouts on nodes using SRP-over-IB storage. Conditional on the ib_srp module being loaded and SRP targets being mounted.

What to do

Update to a stable kernel carrying the srp_abort fix (commits 26788a5b48d9 / b9bdffb3f9aa); the record lists the affected series as 3.1 through 3.7 baselines, so verify your distro backport. Interim: move affected nodes off SRP-over-IB storage, or drain them if SRP timeouts are already being observed.

References

https://git.kernel.org/stable/c/26788a5b48d9d5cd3283d777d238631c8cd7495a https://git.kernel.org/stable/c/b9bdffb3f9aaeff8379c83f5449c6b42cb71c2b5 https://nvd.nist.gov/vuln/detail/CVE-2023-52515

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.