GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-52515 (GCVE-0-2023-52515)

Vulnerability from cvelistv5 – Published: 2024-03-02 21:52 – Updated: 2026-08-05 09:10
VLAI
Title
RDMA/srp: Do not call scsi_done() from srp_abort()
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: Do not call scsi_done() from srp_abort() After scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler callback, it performs one of the following actions: * Call scsi_queue_insert(). * Call scsi_finish_command(). * Call scsi_eh_scmd_add(). Hence, SCSI abort handlers must not call scsi_done(). Otherwise all the above actions would trigger a use-after-free. Hence remove the scsi_done() call from srp_abort(). Keep the srp_free_req() call before returning SUCCESS because we may not see the command again if SUCCESS is returned.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:56 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d8536670916a685df116b5c2cb256573fd25e4e3 , < 26788a5b48d9d5cd3283d777d238631c8cd7495a (git)
Affected: d8536670916a685df116b5c2cb256573fd25e4e3 , < b9bdffb3f9aaeff8379c83f5449c6b42cb71c2b5 (git)
Affected: d8536670916a685df116b5c2cb256573fd25e4e3 , < 2b298f9181582270d5e95774e5a6c7a7fb5b1206 (git)
Affected: d8536670916a685df116b5c2cb256573fd25e4e3 , < 05a10b316adaac1f322007ca9a0383b410d759cc (git)
Affected: d8536670916a685df116b5c2cb256573fd25e4e3 , < e193b7955dfad68035b983a0011f4ef3590c85eb (git)
Affected: 738589592a04180e39b6fb5fe8205d85b7dc69f6 (git)
Affected: 0575df129e2eb4a801beae0e6e041787480f42b9 (git)
Affected: 22fb582405002812d8fb89d0ed1264e97d3d25ad (git)
Affected: 39d6594c457c4728794cb4c3c7be53f93f1ef3ae (git)
Affected: b3f3b814add77a464911df0080d812b18f61ff38 (git)
Affected: 3.0.45 , < 3.1 (semver)
Affected: 3.2.32 , < 3.3 (semver)
Affected: 3.4.13 , < 3.5 (semver)
Affected: 3.5.6 , < 3.6 (semver)
Affected: 3.6.1 , < 3.7 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 3.7
Unaffected: 0 , < 3.7 (semver)
Unaffected: 5.10.199 , ≤ 5.10.* (semver)
Unaffected: 5.15.136 , ≤ 5.15.* (semver)
Unaffected: 6.1.57 , ≤ 6.1.* (semver)
Unaffected: 6.5.7 , ≤ 6.5.* (semver)
Unaffected: 6.6 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:03:20.699Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/26788a5b48d9d5cd3283d777d238631c8cd7495a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b9bdffb3f9aaeff8379c83f5449c6b42cb71c2b5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2b298f9181582270d5e95774e5a6c7a7fb5b1206"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/05a10b316adaac1f322007ca9a0383b410d759cc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e193b7955dfad68035b983a0011f4ef3590c85eb"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52515",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:56:46.822904Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:41.155Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/ulp/srp/ib_srp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "26788a5b48d9d5cd3283d777d238631c8cd7495a",
              "status": "affected",
              "version": "d8536670916a685df116b5c2cb256573fd25e4e3",
              "versionType": "git"
            },
            {
              "lessThan": "b9bdffb3f9aaeff8379c83f5449c6b42cb71c2b5",
              "status": "affected",
              "version": "d8536670916a685df116b5c2cb256573fd25e4e3",
              "versionType": "git"
            },
            {
              "lessThan": "2b298f9181582270d5e95774e5a6c7a7fb5b1206",
              "status": "affected",
              "version": "d8536670916a685df116b5c2cb256573fd25e4e3",
              "versionType": "git"
            },
            {
              "lessThan": "05a10b316adaac1f322007ca9a0383b410d759cc",
              "status": "affected",
              "version": "d8536670916a685df116b5c2cb256573fd25e4e3",
              "versionType": "git"
            },
            {
              "lessThan": "e193b7955dfad68035b983a0011f4ef3590c85eb",
              "status": "affected",
              "version": "d8536670916a685df116b5c2cb256573fd25e4e3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "738589592a04180e39b6fb5fe8205d85b7dc69f6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0575df129e2eb4a801beae0e6e041787480f42b9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "22fb582405002812d8fb89d0ed1264e97d3d25ad",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "39d6594c457c4728794cb4c3c7be53f93f1ef3ae",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b3f3b814add77a464911df0080d812b18f61ff38",
              "versionType": "git"
            },
            {
              "lessThan": "3.1",
              "status": "affected",
              "version": "3.0.45",
              "versionType": "semver"
            },
            {
              "lessThan": "3.3",
              "status": "affected",
              "version": "3.2.32",
              "versionType": "semver"
            },
            {
              "lessThan": "3.5",
              "status": "affected",
              "version": "3.4.13",
              "versionType": "semver"
            },
            {
              "lessThan": "3.6",
              "status": "affected",
              "version": "3.5.6",
              "versionType": "semver"
            },
            {
              "lessThan": "3.7",
              "status": "affected",
              "version": "3.6.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/ulp/srp/ib_srp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.7"
            },
            {
              "lessThan": "3.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.199",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.6",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.199",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.136",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.57",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5.7",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.0.45",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.2.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.6.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srp: Do not call scsi_done() from srp_abort()\n\nAfter scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler\ncallback, it performs one of the following actions:\n* Call scsi_queue_insert().\n* Call scsi_finish_command().\n* Call scsi_eh_scmd_add().\nHence, SCSI abort handlers must not call scsi_done(). Otherwise all\nthe above actions would trigger a use-after-free. Hence remove the\nscsi_done() call from srp_abort(). Keep the srp_free_req() call\nbefore returning SUCCESS because we may not see the command again if\nSUCCESS is returned."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ib_srp is the SRP initiator and supports RDMA CM to IP targets (RoCE/iWARP); a malicious or compromised SRP target drives command timeouts and abort-TM completions over the network to reach srp_abort(), analogous to other malicious-peer storage/network protocol bugs.\nAC:L - The remote target fully controls both sides of the trigger\u2014withholding command completions to force SCSI timeouts and successfully acknowledging SRP_TSK_ABORT_TASK so srp_send_tsk_mgmt() returns success and the buggy scsi_done() path runs\u2014with no uncontrolled race or rare layout dependency.\nPR:N - Once an SRP session exists, the peer target needs no local account or capability on the initiator; fabric/login identity is sufficient and no further host credentials are checked on the abort path.\nUI:N - In the highest-impact deployment, SRP LUNs are already connected and under normal I/O; the attacker only needs to stall in-flight commands and ACK aborts, with no additional victim mount or interactive action at exploit time.\nS:U - The use-after-free corrupts scsi_cmnd/block-layer state inside the initiator host kernel under a single security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - The bug is an explicit use-after-free from calling scsi_done() in the abort handler while scmd_eh_abort_handler() still runs scsi_finish_command()/scsi_queue_insert()/scsi_eh_scmd_add() on the same command, which per guidance enables arbitrary kernel read primitives via object reuse.\nI:H - The same UAF on the SCSI command/request object is heap memory corruption that can be groomed for arbitrary write and control-flow hijack once the freed object is reclaimed.\nA:H - Double-completing or otherwise operating on the freed scsi_cmnd reliably causes kernel oops/panic or severe SCSI error-handler failure even when not fully exploited."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:10:20.389Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/26788a5b48d9d5cd3283d777d238631c8cd7495a"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9bdffb3f9aaeff8379c83f5449c6b42cb71c2b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b298f9181582270d5e95774e5a6c7a7fb5b1206"
        },
        {
          "url": "https://git.kernel.org/stable/c/05a10b316adaac1f322007ca9a0383b410d759cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/e193b7955dfad68035b983a0011f4ef3590c85eb"
        }
      ],
      "title": "RDMA/srp: Do not call scsi_done() from srp_abort()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52515",
    "datePublished": "2024-03-02T21:52:25.863Z",
    "dateReserved": "2024-02-20T12:30:33.316Z",
    "dateUpdated": "2026-08-05T09:10:20.389Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-52515",
      "date": "2026-09-19",
      "epss": "0.00613",
      "percentile": "0.47987"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "82480FAE-E3F8-4E1D-AE32-3EC355B1D261",
                  "versionEndExcluding": "5.10.199",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "B1FA5161-3AC0-44DF-B1F7-93A070F2B1E7",
                  "versionEndExcluding": "5.15.136",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "8629E5D1-351D-4D4B-8D05-E10BD4A1CFD0",
                  "versionEndExcluding": "6.1.57",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "830A824C-F212-4FDC-ADEF-0EBEC6B2365B",
                  "versionEndExcluding": "6.5.7",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.6:rc1:*:*:*:*:*:*",
                  "matchCriteriaId": "84267A4F-DBC2-444F-B41D-69E15E1BEC97",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.6:rc2:*:*:*:*:*:*",
                  "matchCriteriaId": "FB440208-241C-4246-9A83-C1715C0DAA6C",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.6:rc3:*:*:*:*:*:*",
                  "matchCriteriaId": "0DC421F1-3D5A-4BEF-BF76-4E468985D20B",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.6:rc4:*:*:*:*:*:*",
                  "matchCriteriaId": "00AB783B-BE05-40E8-9A55-6AA457D95031",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srp: Do not call scsi_done() from srp_abort()\n\nAfter scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler\ncallback, it performs one of the following actions:\n* Call scsi_queue_insert().\n* Call scsi_finish_command().\n* Call scsi_eh_scmd_add().\nHence, SCSI abort handlers must not call scsi_done(). Otherwise all\nthe above actions would trigger a use-after-free. Hence remove the\nscsi_done() call from srp_abort(). Keep the srp_free_req() call\nbefore returning SUCCESS because we may not see the command again if\nSUCCESS is returned."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: RDMA/srp: No llamar a scsi_done() desde srp_abort() Despu\u00e9s de que scmd_eh_abort_handler() haya llamado a la devoluci\u00f3n de llamada SCSI LLD eh_abort_handler, realiza una de las siguientes acciones: * Llamar a scsi_queue_insert( ). * Llame a scsi_finish_command(). * Llame a scsi_eh_scmd_add(). Por lo tanto, los controladores de abortos SCSI no deben llamar a scsi_done(). De lo contrario, todas las acciones anteriores desencadenar\u00edan un Use After Free. Por lo tanto, elimine la llamada scsi_done() de srp_abort(). Mantenga la llamada srp_free_req() antes de devolver SUCCESS porque es posible que no veamos el comando nuevamente si se devuelve SUCCESS."
        }
      ],
      "id": "CVE-2023-52515",
      "lastModified": "2024-12-11T16:41:11.770",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-03-02T22:15:47.823",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/05a10b316adaac1f322007ca9a0383b410d759cc"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/26788a5b48d9d5cd3283d777d238631c8cd7495a"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/2b298f9181582270d5e95774e5a6c7a7fb5b1206"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/b9bdffb3f9aaeff8379c83f5449c6b42cb71c2b5"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/e193b7955dfad68035b983a0011f4ef3590c85eb"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/05a10b316adaac1f322007ca9a0383b410d759cc"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/26788a5b48d9d5cd3283d777d238631c8cd7495a"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/2b298f9181582270d5e95774e5a6c7a7fb5b1206"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/b9bdffb3f9aaeff8379c83f5449c6b42cb71c2b5"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/e193b7955dfad68035b983a0011f4ef3590c85eb"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-416"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/ulp/srp/ib_srp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "26788a5b48d9d5cd3283d777d238631c8cd7495a",
                    "status": "affected",
                    "version": "d8536670916a685df116b5c2cb256573fd25e4e3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b9bdffb3f9aaeff8379c83f5449c6b42cb71c2b5",
                    "status": "affected",
                    "version": "d8536670916a685df116b5c2cb256573fd25e4e3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2b298f9181582270d5e95774e5a6c7a7fb5b1206",
                    "status": "affected",
                    "version": "d8536670916a685df116b5c2cb256573fd25e4e3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "05a10b316adaac1f322007ca9a0383b410d759cc",
                    "status": "affected",
                    "version": "d8536670916a685df116b5c2cb256573fd25e4e3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e193b7955dfad68035b983a0011f4ef3590c85eb",
                    "status": "affected",
                    "version": "d8536670916a685df116b5c2cb256573fd25e4e3",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "738589592a04180e39b6fb5fe8205d85b7dc69f6",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "0575df129e2eb4a801beae0e6e041787480f42b9",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "22fb582405002812d8fb89d0ed1264e97d3d25ad",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "39d6594c457c4728794cb4c3c7be53f93f1ef3ae",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "b3f3b814add77a464911df0080d812b18f61ff38",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3.1",
                    "status": "affected",
                    "version": "3.0.45",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "3.3",
                    "status": "affected",
                    "version": "3.2.32",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "3.5",
                    "status": "affected",
                    "version": "3.4.13",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "3.6",
                    "status": "affected",
                    "version": "3.5.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "3.7",
                    "status": "affected",
                    "version": "3.6.1",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/ulp/srp/ib_srp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.7"
                  },
                  {
                    "lessThan": "3.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.199",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.136",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.57",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.5.*",
                    "status": "unaffected",
                    "version": "6.5.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.6",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "82480FAE-E3F8-4E1D-AE32-3EC355B1D261",
                    "versionEndExcluding": "5.10.199",
                    "versionStartIncluding": "3.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B1FA5161-3AC0-44DF-B1F7-93A070F2B1E7",
                    "versionEndExcluding": "5.15.136",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8629E5D1-351D-4D4B-8D05-E10BD4A1CFD0",
                    "versionEndExcluding": "6.1.57",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "830A824C-F212-4FDC-ADEF-0EBEC6B2365B",
                    "versionEndExcluding": "6.5.7",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.6:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "84267A4F-DBC2-444F-B41D-69E15E1BEC97",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.6:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "FB440208-241C-4246-9A83-C1715C0DAA6C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.6:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "0DC421F1-3D5A-4BEF-BF76-4E468985D20B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.6:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "00AB783B-BE05-40E8-9A55-6AA457D95031",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srp: Do not call scsi_done() from srp_abort()\n\nAfter scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler\ncallback, it performs one of the following actions:\n* Call scsi_queue_insert().\n* Call scsi_finish_command().\n* Call scsi_eh_scmd_add().\nHence, SCSI abort handlers must not call scsi_done(). Otherwise all\nthe above actions would trigger a use-after-free. Hence remove the\nscsi_done() call from srp_abort(). Keep the srp_free_req() call\nbefore returning SUCCESS because we may not see the command again if\nSUCCESS is returned."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: RDMA/srp: No llamar a scsi_done() desde srp_abort() Despu\u00e9s de que scmd_eh_abort_handler() haya llamado a la devoluci\u00f3n de llamada SCSI LLD eh_abort_handler, realiza una de las siguientes acciones: * Llamar a scsi_queue_insert( ). * Llame a scsi_finish_command(). * Llame a scsi_eh_scmd_add(). Por lo tanto, los controladores de abortos SCSI no deben llamar a scsi_done(). De lo contrario, todas las acciones anteriores desencadenar\u00edan un Use After Free. Por lo tanto, elimine la llamada scsi_done() de srp_abort(). Mantenga la llamada srp_free_req() antes de devolver SUCCESS porque es posible que no veamos el comando nuevamente si se devuelve SUCCESS."
          }
        ],
        "id": "CVE-2023-52515",
        "lastModified": "2026-08-04T10:18:31.297",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2023-52515",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:56:46.822904Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-03-02T22:15:47.823",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/05a10b316adaac1f322007ca9a0383b410d759cc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/26788a5b48d9d5cd3283d777d238631c8cd7495a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2b298f9181582270d5e95774e5a6c7a7fb5b1206"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b9bdffb3f9aaeff8379c83f5449c6b42cb71c2b5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e193b7955dfad68035b983a0011f4ef3590c85eb"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/05a10b316adaac1f322007ca9a0383b410d759cc"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/26788a5b48d9d5cd3283d777d238631c8cd7495a"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2b298f9181582270d5e95774e5a6c7a7fb5b1206"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b9bdffb3f9aaeff8379c83f5449c6b42cb71c2b5"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e193b7955dfad68035b983a0011f4ef3590c85eb"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:57:56+00:00",
      "cve": "CVE-2023-52515",
      "id": "CVE-2023-52515",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: RDMA/srp: Do not call scsi_done() from srp_abort()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-52515.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T01:06:32Z",
      "cve": "CVE-2023-52515",
      "id": "CVE-2023-52515",
      "initial_release_date": "2024-03-07T04:25:55Z",
      "product_status:known_affected": "469",
      "product_status:known_not_affected": "66",
      "product_status:recommended": "757",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-52515",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-52515.json",
      "version": "76"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T23:03:20.699Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/26788a5b48d9d5cd3283d777d238631c8cd7495a"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/b9bdffb3f9aaeff8379c83f5449c6b42cb71c2b5"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/2b298f9181582270d5e95774e5a6c7a7fb5b1206"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/05a10b316adaac1f322007ca9a0383b410d759cc"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/e193b7955dfad68035b983a0011f4ef3590c85eb"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-52515",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-10T15:56:46.822904Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-11T12:42:18.124Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/infiniband/ulp/srp/ib_srp.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "26788a5b48d9d5cd3283d777d238631c8cd7495a",
                  "status": "affected",
                  "version": "d8536670916a685df116b5c2cb256573fd25e4e3",
                  "versionType": "git"
                },
                {
                  "lessThan": "b9bdffb3f9aaeff8379c83f5449c6b42cb71c2b5",
                  "status": "affected",
                  "version": "d8536670916a685df116b5c2cb256573fd25e4e3",
                  "versionType": "git"
                },
                {
                  "lessThan": "2b298f9181582270d5e95774e5a6c7a7fb5b1206",
                  "status": "affected",
                  "version": "d8536670916a685df116b5c2cb256573fd25e4e3",
                  "versionType": "git"
                },
                {
                  "lessThan": "05a10b316adaac1f322007ca9a0383b410d759cc",
                  "status": "affected",
                  "version": "d8536670916a685df116b5c2cb256573fd25e4e3",
                  "versionType": "git"
                },
                {
                  "lessThan": "e193b7955dfad68035b983a0011f4ef3590c85eb",
                  "status": "affected",
                  "version": "d8536670916a685df116b5c2cb256573fd25e4e3",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "738589592a04180e39b6fb5fe8205d85b7dc69f6",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "0575df129e2eb4a801beae0e6e041787480f42b9",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "22fb582405002812d8fb89d0ed1264e97d3d25ad",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "39d6594c457c4728794cb4c3c7be53f93f1ef3ae",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "b3f3b814add77a464911df0080d812b18f61ff38",
                  "versionType": "git"
                },
                {
                  "lessThan": "3.1",
                  "status": "affected",
                  "version": "3.0.45",
                  "versionType": "semver"
                },
                {
                  "lessThan": "3.3",
                  "status": "affected",
                  "version": "3.2.32",
                  "versionType": "semver"
                },
                {
                  "lessThan": "3.5",
                  "status": "affected",
                  "version": "3.4.13",
                  "versionType": "semver"
                },
                {
                  "lessThan": "3.6",
                  "status": "affected",
                  "version": "3.5.6",
                  "versionType": "semver"
                },
                {
                  "lessThan": "3.7",
                  "status": "affected",
                  "version": "3.6.1",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/infiniband/ulp/srp/ib_srp.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "3.7"
                },
                {
                  "lessThan": "3.7",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.199",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.136",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.57",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.5.*",
                  "status": "unaffected",
                  "version": "6.5.7",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.6",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.199",
                      "versionStartIncluding": "3.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.136",
                      "versionStartIncluding": "3.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.57",
                      "versionStartIncluding": "3.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.5.7",
                      "versionStartIncluding": "3.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6",
                      "versionStartIncluding": "3.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "3.0.45",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "3.2.32",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "3.4.13",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "3.5.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "3.6.1",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srp: Do not call scsi_done() from srp_abort()\n\nAfter scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler\ncallback, it performs one of the following actions:\n* Call scsi_queue_insert().\n* Call scsi_finish_command().\n* Call scsi_eh_scmd_add().\nHence, SCSI abort handlers must not call scsi_done(). Otherwise all\nthe above actions would trigger a use-after-free. Hence remove the\nscsi_done() call from srp_abort(). Keep the srp_free_req() call\nbefore returning SUCCESS because we may not see the command again if\nSUCCESS is returned."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:N - ib_srp is the SRP initiator and supports RDMA CM to IP targets (RoCE/iWARP); a malicious or compromised SRP target drives command timeouts and abort-TM completions over the network to reach srp_abort(), analogous to other malicious-peer storage/network protocol bugs.\nAC:L - The remote target fully controls both sides of the trigger\u2014withholding command completions to force SCSI timeouts and successfully acknowledging SRP_TSK_ABORT_TASK so srp_send_tsk_mgmt() returns success and the buggy scsi_done() path runs\u2014with no uncontrolled race or rare layout dependency.\nPR:N - Once an SRP session exists, the peer target needs no local account or capability on the initiator; fabric/login identity is sufficient and no further host credentials are checked on the abort path.\nUI:N - In the highest-impact deployment, SRP LUNs are already connected and under normal I/O; the attacker only needs to stall in-flight commands and ACK aborts, with no additional victim mount or interactive action at exploit time.\nS:U - The use-after-free corrupts scsi_cmnd/block-layer state inside the initiator host kernel under a single security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - The bug is an explicit use-after-free from calling scsi_done() in the abort handler while scmd_eh_abort_handler() still runs scsi_finish_command()/scsi_queue_insert()/scsi_eh_scmd_add() on the same command, which per guidance enables arbitrary kernel read primitives via object reuse.\nI:H - The same UAF on the SCSI command/request object is heap memory corruption that can be groomed for arbitrary write and control-flow hijack once the freed object is reclaimed.\nA:H - Double-completing or otherwise operating on the freed scsi_cmnd reliably causes kernel oops/panic or severe SCSI error-handler failure even when not fully exploited."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T09:10:20.389Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/26788a5b48d9d5cd3283d777d238631c8cd7495a"
            },
            {
              "url": "https://git.kernel.org/stable/c/b9bdffb3f9aaeff8379c83f5449c6b42cb71c2b5"
            },
            {
              "url": "https://git.kernel.org/stable/c/2b298f9181582270d5e95774e5a6c7a7fb5b1206"
            },
            {
              "url": "https://git.kernel.org/stable/c/05a10b316adaac1f322007ca9a0383b410d759cc"
            },
            {
              "url": "https://git.kernel.org/stable/c/e193b7955dfad68035b983a0011f4ef3590c85eb"
            }
          ],
          "title": "RDMA/srp: Do not call scsi_done() from srp_abort()",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2023-52515",
        "datePublished": "2024-03-02T21:52:25.863Z",
        "dateReserved": "2024-02-20T12:30:33.316Z",
        "dateUpdated": "2026-08-05T09:10:20.389Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.