CVE-2023-53320

scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info()

High · published September 16, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
4.2
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info()

The function mpi3mr_get_all_tgt_info() has four issues:

1) It calculates valid entry length in alltgt_info assuming the header part

of the struct mpi3mr_device_map_info would equal to sizeof(u32). The

correct size is sizeof(u64).

2) When it calculates the valid entry length kern_entrylen, it excludes one

entry by subtracting 1 from num_devices.

3) It copies num_device by calling memcpy(). Substitution is enough.

4) It does not specify the calculated length to sg_copy_from_buffer().

Instead, it specifies the payload length which is larger than the

alltgt_info size. It causes "BUG: KASAN: slab-out-of-bounds".

Fix the issues by using the correct header size, removing the subtraction

from num_devices, replacing the memcpy() with substitution and specifying

the correct length to sg_copy_from_buffer().

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00154 · 4.2th percentile
Published
2025-09-16T16:11Z
EPSS history
Timeline
  • 16 SEP 16:11Z
    scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info()
    cvelistv5