Linux kernel scsi/ses: out-of-bounds read walking enclosure additional descriptors

CVSS 8.1CVE-2023-7324Firmware, BMC & network fabriccurated

Impact

The SES driver walked the additional element descriptors returned by a SCSI enclosure without sanitizing addl_desc_ptr against the end of the page, giving a slab out-of-bounds read reported by KASAN during the udev-triggered enclosure probe. The data comes from the enclosure services device itself, so the trigger is an expander or enclosure firmware - compromised, buggy, or hostile - attached to a storage node; the read can panic the host or leak adjacent slab contents into enclosure state. On dense GPU and storage chassis the SES driver loads automatically at boot and on hotplug, so this is reached without anyone logging in. CVE-2023-7324 and CVE-2023-53803 are two separate fixes to this same walk, landing in different commit sets; they are kept as distinct entries because the fixed commits differ.

Who can reach it

An attached SCSI enclosure services device returning malformed descriptors - reachable by whoever controls enclosure or expander firmware, or by physically attaching a device. No host login required; the probe runs from systemd-udevd at boot or hotplug.

What to do

Take a stable kernel carrying the fix (commits in the references) and reboot the affected storage and GPU nodes; the ses module can be unloaded in principle but is bound to live enclosure devices, so a drain and reboot is the realistic path. Blacklisting the ses module on nodes that do not need enclosure management removes the exposure where enclosure telemetry is not used.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-7324 https://git.kernel.org/stable/c/27067c672980b497cc34048b69b12820851ac6b9 https://git.kernel.org/stable/c/a156a262c543fa5ff30bcb2fc6ad1a95cb4ab57a

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.