Memory Access Vulnerability in Linux Kernel's mpi3mr Driver
Summary
CVE-2023-53376: In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Use number of bits to manage bitmap sizes To allocate bitmaps, the mpi3mr driver calculates sizes of bitmaps using byte as unit. Affects linux versions < 6.1.20-1. Fixed in 6.1.20-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. The mpi3mr driver is responsible for managing SCSI (Small Computer System Interface) devices, particularly in environments requiring high-performance storage solutions. This driver is crucial for ensuring efficient communication between the operating system and storage hardware. However, it has been identified that the driver miscalculates bitmap sizes, leading to potential memory access violations.
Vulnerability Detail
The vulnerability, identified as CVE-2023-53376, arises from the mpi3mr driver incorrectly calculating bitmap sizes using bytes instead of bits. This discrepancy leads to memory access beyond the allocated bitmap sizes, resulting in a 'BUG: KASAN: slab-out-of-bounds' error. Such out-of-bounds access can cause system instability, crashes, or unexpected behavior, particularly during firmware downloads to eHBA-9600 devices. The issue was traced back to the find_first_zero_bit() function, which was called with incorrect parameters, leading to memory corruption.
How To Fix
Minimum fixed version
6.1.20-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the mpi3mr driver until the package is updated. Additionally, if feasible, consider using alternative drivers for SCSI devices that do not exhibit this vulnerability.
Conclusion
CVE-2023-53376 presents a significant risk to systems utilizing the Linux kernel's mpi3mr driver due to improper bitmap size management. Users are strongly encouraged to update to the patched version to mitigate potential risks associated with this vulnerability.
See every vulnerability recorded for linux →
FAQ
CVE-2023-53376 is a vulnerability in the Linux kernel's mpi3mr driver that can lead to memory access violations due to incorrect bitmap size calculations.
This vulnerability can cause system crashes, instability, or unexpected behavior, particularly during firmware downloads to specific SCSI devices.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If an immediate update is not possible, consider using alternative drivers for SCSI devices or refrain from using the mpi3mr driver until a fix is applied.
Detailed information about CVE-2023-53376 can be found in the official CVE database or by visiting the source link provided in the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.