CVE-2023-52500 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command Tags allocated for OPC_INB_SET_CONTROLLER_CONFIG command need to be freed when we receive the response.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Linux	Linux Kernel

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:6.6:rc1::::::

No data.

References

Link	Providers
https://git.kernel.org/stable/c/2259e1901b2d8c0e8538fc99e77de443b939e749
https://git.kernel.org/stable/c/22e6d783a33015bcdf0979015e4eac603912bea7
https://git.kernel.org/stable/c/2afd8fcee0c4d65a482e30c3ad2a92c25e5e92d4
https://git.kernel.org/stable/c/c13e7331745852d0dd7c35eabbe181cbd5b01172
https://git.kernel.org/stable/c/d540a4370aba378fbedf349ba0bb68e96e24243d
https://lore.kernel.org/linux-cve-announce/2024030248-CVE-2023-52500-3d53@gregkh/T/#u
https://nvd.nist.gov/vuln/detail/CVE-2023-52500
https://www.cve.org/CVERecord?id=CVE-2023-52500

History

Tue, 14 Jan 2025 08:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux Linux linux Kernel
Weaknesses		NVD-CWE-Other
CPEs		cpe:2.3:o:linux:linux_kernel:::::::: cpe:2.3:o:linux:linux_kernel:6.6:rc1::::::
Vendors & Products		Linux Linux linux Kernel
Metrics	cvssV3_1 `{'score': 6.0, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H'}`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-03-02T21:52:15.903Z

Updated: 2024-12-19T08:21:01.024Z

Reserved: 2024-02-20T12:30:33.313Z

Link: CVE-2023-52500

Vulnrichment

Updated: 2024-08-02T23:03:19.955Z

NVD

Status : Analyzed

Published: 2024-03-02T22:15:47.103

Modified: 2025-01-13T18:43:18.007

Link: CVE-2023-52500

Redhat

Severity : Low

Publid Date: 2024-03-02T00:00:00Z

Links: CVE-2023-52500 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-52500", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-20T12:30:33.313Z", "datePublished": "2024-03-02T21:52:15.903Z", "dateUpdated": "2024-12-19T08:21:01.024Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-12-19T08:21:01.024Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command\n\nTags allocated for OPC_INB_SET_CONTROLLER_CONFIG command need to be freed\nwhen we receive the response."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/scsi/pm8001/pm80xx_hwi.c"], "versions": [{"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "2afd8fcee0c4d65a482e30c3ad2a92c25e5e92d4", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "d540a4370aba378fbedf349ba0bb68e96e24243d", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "2259e1901b2d8c0e8538fc99e77de443b939e749", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "22e6d783a33015bcdf0979015e4eac603912bea7", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "c13e7331745852d0dd7c35eabbe181cbd5b01172", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/scsi/pm8001/pm80xx_hwi.c"], "versions": [{"version": "5.10.198", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.134", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.56", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.5.6", "lessThanOrEqual": "6.5.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/2afd8fcee0c4d65a482e30c3ad2a92c25e5e92d4"}, {"url": "https://git.kernel.org/stable/c/d540a4370aba378fbedf349ba0bb68e96e24243d"}, {"url": "https://git.kernel.org/stable/c/2259e1901b2d8c0e8538fc99e77de443b939e749"}, {"url": "https://git.kernel.org/stable/c/22e6d783a33015bcdf0979015e4eac603912bea7"}, {"url": "https://git.kernel.org/stable/c/c13e7331745852d0dd7c35eabbe181cbd5b01172"}], "title": "scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command", "x_generator": {"engine": "bippy-5f407fcff5a0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-52500", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-07T16:04:17.175874Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:23:57.406Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:03:19.955Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/2afd8fcee0c4d65a482e30c3ad2a92c25e5e92d4", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d540a4370aba378fbedf349ba0bb68e96e24243d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2259e1901b2d8c0e8538fc99e77de443b939e749", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/22e6d783a33015bcdf0979015e4eac603912bea7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c13e7331745852d0dd7c35eabbe181cbd5b01172", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/2afd8fcee0c4d65a482e30c3ad2a92c25e5e92d4", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d540a4370aba378fbedf349ba0bb68e96e24243d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2259e1901b2d8c0e8538fc99e77de443b939e749", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/22e6d783a33015bcdf0979015e4eac603912bea7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c13e7331745852d0dd7c35eabbe181cbd5b01172", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:03:19.955Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-52500", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-07T16:04:17.175874Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:16.317Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1da177e4c3f4", "lessThan": "2afd8fcee0c4", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "d540a4370aba", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "2259e1901b2d", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "22e6d783a330", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "c13e73317458", "versionType": "git"}], "programFiles": ["drivers/scsi/pm8001/pm80xx_hwi.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "unaffected", "version": "5.10.198", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.134", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.56", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.5.6", "versionType": "semver", "lessThanOrEqual": "6.5.*"}, {"status": "unaffected", "version": "6.6", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/scsi/pm8001/pm80xx_hwi.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/2afd8fcee0c4d65a482e30c3ad2a92c25e5e92d4"}, {"url": "https://git.kernel.org/stable/c/d540a4370aba378fbedf349ba0bb68e96e24243d"}, {"url": "https://git.kernel.org/stable/c/2259e1901b2d8c0e8538fc99e77de443b939e749"}, {"url": "https://git.kernel.org/stable/c/22e6d783a33015bcdf0979015e4eac603912bea7"}, {"url": "https://git.kernel.org/stable/c/c13e7331745852d0dd7c35eabbe181cbd5b01172"}], "x_generator": {"engine": "bippy-9e1c9544281a"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command\n\nTags allocated for OPC_INB_SET_CONTROLLER_CONFIG command need to be freed\nwhen we receive the response."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T14:48:04.039Z"}}}, "cveMetadata": {"cveId": "CVE-2023-52500", "state": "PUBLISHED", "dateUpdated": "2024-11-04T14:48:04.039Z", "dateReserved": "2024-02-20T12:30:33.313Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-03-02T21:52:15.903Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "71BA73D5-437E-41B7-8F92-323BFBC81366", "versionEndExcluding": "5.10.198", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "346A7B1E-5048-460C-9640-5EFA2075158B", "versionEndExcluding": "5.15.134", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5EA89569-DD45-4A69-BB4D-8356FA9386BD", "versionEndExcluding": "6.1.56", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "870FC772-173A-4A0F-B1AF-7976AD6057D3", "versionEndExcluding": "6.5.6", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.6:rc1:*:*:*:*:*:*", "matchCriteriaId": "84267A4F-DBC2-444F-B41D-69E15E1BEC97", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command\n\nTags allocated for OPC_INB_SET_CONTROLLER_CONFIG command need to be freed\nwhen we receive the response."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: pm80xx: evite filtrar etiquetas al procesar el comando OPC_INB_SET_CONTROLLER_CONFIG Las etiquetas asignadas para el comando OPC_INB_SET_CONTROLLER_CONFIG deben liberarse cuando recibimos la respuesta."}], "id": "CVE-2023-52500", "lastModified": "2025-01-13T18:43:18.007", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-03-02T22:15:47.103", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2259e1901b2d8c0e8538fc99e77de443b939e749"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/22e6d783a33015bcdf0979015e4eac603912bea7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2afd8fcee0c4d65a482e30c3ad2a92c25e5e92d4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c13e7331745852d0dd7c35eabbe181cbd5b01172"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d540a4370aba378fbedf349ba0bb68e96e24243d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2259e1901b2d8c0e8538fc99e77de443b939e749"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/22e6d783a33015bcdf0979015e4eac603912bea7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2afd8fcee0c4d65a482e30c3ad2a92c25e5e92d4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c13e7331745852d0dd7c35eabbe181cbd5b01172"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d540a4370aba378fbedf349ba0bb68e96e24243d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}