CVE-2023-54184 (GCVE-0-2023-54184)

Vulnerability from cvelistv5 – Published: 2025-12-30 12:08 – Updated: 2026-08-05 09:17
VLAI
Title
scsi: target: iscsit: Free cmds before session free
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsit: Free cmds before session free Commands from recovery entries are freed after session has been closed. That leads to use-after-free at command free or NPE with such call trace: Time2Retain timer expired for SID: 1, cleaning up iSCSI session. BUG: kernel NULL pointer dereference, address: 0000000000000140 RIP: 0010:sbitmap_queue_clear+0x3a/0xa0 Call Trace: target_release_cmd_kref+0xd1/0x1f0 [target_core_mod] transport_generic_free_cmd+0xd1/0x180 [target_core_mod] iscsit_free_cmd+0x53/0xd0 [iscsi_target_mod] iscsit_free_connection_recovery_entries+0x29d/0x320 [iscsi_target_mod] iscsit_close_session+0x13a/0x140 [iscsi_target_mod] iscsit_check_post_dataout+0x440/0x440 [iscsi_target_mod] call_timer_fn+0x24/0x140 Move cleanup of recovery enrties to before session freeing.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 988e3a85463d9b6dabc681df3f8f131b23c19953 , < 89f5055f9b0b57c7e7f02e32df95ef401f809b71 (git)
Affected: 988e3a85463d9b6dabc681df3f8f131b23c19953 , < 4621e24c9257c6379343bf0c11b473817cf7edcd (git)
Affected: 988e3a85463d9b6dabc681df3f8f131b23c19953 , < 1911cca5916b6e106de7afa3ec0a38447158216c (git)
Affected: 988e3a85463d9b6dabc681df3f8f131b23c19953 , < a7a4def6c7046e090bb10c6d550fdeb487db98ba (git)
Affected: 988e3a85463d9b6dabc681df3f8f131b23c19953 , < 4ce221d295f53e6c6b835ab33181e735482c9aac (git)
Affected: 988e3a85463d9b6dabc681df3f8f131b23c19953 , < d8990b5a4d065f38f35d69bcd627ec5a7f8330ca (git)
Create a notification for this product.
Linux Linux Affected: 3.12
Unaffected: 0 , < 3.12 (semver)
Unaffected: 5.4.244 , ≤ 5.4.* (semver)
Unaffected: 5.10.181 , ≤ 5.10.* (semver)
Unaffected: 5.15.113 , ≤ 5.15.* (semver)
Unaffected: 6.1.30 , ≤ 6.1.* (semver)
Unaffected: 6.3.4 , ≤ 6.3.* (semver)
Unaffected: 6.4 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/target/iscsi/iscsi_target.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "89f5055f9b0b57c7e7f02e32df95ef401f809b71",
              "status": "affected",
              "version": "988e3a85463d9b6dabc681df3f8f131b23c19953",
              "versionType": "git"
            },
            {
              "lessThan": "4621e24c9257c6379343bf0c11b473817cf7edcd",
              "status": "affected",
              "version": "988e3a85463d9b6dabc681df3f8f131b23c19953",
              "versionType": "git"
            },
            {
              "lessThan": "1911cca5916b6e106de7afa3ec0a38447158216c",
              "status": "affected",
              "version": "988e3a85463d9b6dabc681df3f8f131b23c19953",
              "versionType": "git"
            },
            {
              "lessThan": "a7a4def6c7046e090bb10c6d550fdeb487db98ba",
              "status": "affected",
              "version": "988e3a85463d9b6dabc681df3f8f131b23c19953",
              "versionType": "git"
            },
            {
              "lessThan": "4ce221d295f53e6c6b835ab33181e735482c9aac",
              "status": "affected",
              "version": "988e3a85463d9b6dabc681df3f8f131b23c19953",
              "versionType": "git"
            },
            {
              "lessThan": "d8990b5a4d065f38f35d69bcd627ec5a7f8330ca",
              "status": "affected",
              "version": "988e3a85463d9b6dabc681df3f8f131b23c19953",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/target/iscsi/iscsi_target.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "lessThan": "3.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.244",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.181",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.244",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.181",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.113",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.30",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.4",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsit: Free cmds before session free\n\nCommands from recovery entries are freed after session has been closed.\nThat leads to use-after-free at command free or NPE with such call trace:\n\nTime2Retain timer expired for SID: 1, cleaning up iSCSI session.\nBUG: kernel NULL pointer dereference, address: 0000000000000140\nRIP: 0010:sbitmap_queue_clear+0x3a/0xa0\nCall Trace:\n target_release_cmd_kref+0xd1/0x1f0 [target_core_mod]\n transport_generic_free_cmd+0xd1/0x180 [target_core_mod]\n iscsit_free_cmd+0x53/0xd0 [iscsi_target_mod]\n iscsit_free_connection_recovery_entries+0x29d/0x320 [iscsi_target_mod]\n iscsit_close_session+0x13a/0x140 [iscsi_target_mod]\n iscsit_check_post_dataout+0x440/0x440 [iscsi_target_mod]\n call_timer_fn+0x24/0x140\n\nMove cleanup of recovery enrties to before session freeing."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The LIO in-kernel iSCSI target (drivers/target/iscsi) serves remote initiators over TCP/3260, and the entire trigger sequence \u2014 ERL=2 login negotiation, issuing SCSI commands, and dropping the connection to strand them in a recovery entry \u2014 is performed purely with network PDUs from a remote peer.\nAC:L - The free-then-use ordering in iscsit_close_session() is unconditional, not a race, so a remote initiator deterministically reaches it by negotiating ErrorRecoveryLevel=2, leaving commands outstanding, and dropping the TCP connection until the Time2Retain timer expires; connection-recovery (default_erl=2) is a supported deployment configuration, i.e. part of the vulnerable configuration rather than a condition outside the attacker\u0027s control.\nPR:N - iscsi_conn_auth_required() defers entirely to the TPG/ACL authentication attribute, and iSCSI targets are routinely deployed with authentication disabled and/or generate_node_acls=1 (demo mode), letting any host that can reach TCP/3260 establish a normal session with no credentials whatsoever.\nUI:N - No action by any local user or administrator is needed; the attacker drives session setup, connection failure, and the Time2Retain expiry entirely from the network.\nS:U - The use-after-free corrupts kernel memory within the same security authority as the vulnerable kernel; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - iscsit_free_cmd() dereferences struct iscsit_cmd objects living inside the kvfree\u0027d sess_cmd_map and the freed se_sess, so contents of reallocated kernel memory are read back and acted upon; an attacker who reclaims that region with sprayed iSCSI data gains a controlled read/disclosure primitive.\nI:H - The UAF writes into freed memory (list_del_init on datain/r2t lists, cmd-\u003econn = NULL, spinlock acquisition, sbitmap_queue_clear into the freed tag pool) and performs kfree() on cmd-\u003ebuf_ptr and cmd-\u003epdu_list pointers read out of freed memory, yielding arbitrary-free and heap-corruption primitives suitable for control-flow hijacking.\nA:H - The reported failure is a kernel NULL pointer dereference in sbitmap_queue_clear() from call_timer_fn() (softirq context), an immediate oops/panic that a remote attacker can trigger repeatedly by opening and abandoning sessions."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:17:52.229Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/89f5055f9b0b57c7e7f02e32df95ef401f809b71"
        },
        {
          "url": "https://git.kernel.org/stable/c/4621e24c9257c6379343bf0c11b473817cf7edcd"
        },
        {
          "url": "https://git.kernel.org/stable/c/1911cca5916b6e106de7afa3ec0a38447158216c"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7a4def6c7046e090bb10c6d550fdeb487db98ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ce221d295f53e6c6b835ab33181e735482c9aac"
        },
        {
          "url": "https://git.kernel.org/stable/c/d8990b5a4d065f38f35d69bcd627ec5a7f8330ca"
        }
      ],
      "title": "scsi: target: iscsit: Free cmds before session free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54184",
    "datePublished": "2025-12-30T12:08:54.528Z",
    "dateReserved": "2025-12-30T12:06:44.497Z",
    "dateUpdated": "2026-08-05T09:17:52.229Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-54184",
      "date": "2026-10-02",
      "epss": "0.00572",
      "percentile": "0.45299"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/target/iscsi/iscsi_target.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "89f5055f9b0b57c7e7f02e32df95ef401f809b71",
                    "status": "affected",
                    "version": "988e3a85463d9b6dabc681df3f8f131b23c19953",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4621e24c9257c6379343bf0c11b473817cf7edcd",
                    "status": "affected",
                    "version": "988e3a85463d9b6dabc681df3f8f131b23c19953",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1911cca5916b6e106de7afa3ec0a38447158216c",
                    "status": "affected",
                    "version": "988e3a85463d9b6dabc681df3f8f131b23c19953",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a7a4def6c7046e090bb10c6d550fdeb487db98ba",
                    "status": "affected",
                    "version": "988e3a85463d9b6dabc681df3f8f131b23c19953",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4ce221d295f53e6c6b835ab33181e735482c9aac",
                    "status": "affected",
                    "version": "988e3a85463d9b6dabc681df3f8f131b23c19953",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d8990b5a4d065f38f35d69bcd627ec5a7f8330ca",
                    "status": "affected",
                    "version": "988e3a85463d9b6dabc681df3f8f131b23c19953",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/target/iscsi/iscsi_target.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.12"
                  },
                  {
                    "lessThan": "3.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.244",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.181",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.113",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.30",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.3.*",
                    "status": "unaffected",
                    "version": "6.3.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.4",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsit: Free cmds before session free\n\nCommands from recovery entries are freed after session has been closed.\nThat leads to use-after-free at command free or NPE with such call trace:\n\nTime2Retain timer expired for SID: 1, cleaning up iSCSI session.\nBUG: kernel NULL pointer dereference, address: 0000000000000140\nRIP: 0010:sbitmap_queue_clear+0x3a/0xa0\nCall Trace:\n target_release_cmd_kref+0xd1/0x1f0 [target_core_mod]\n transport_generic_free_cmd+0xd1/0x180 [target_core_mod]\n iscsit_free_cmd+0x53/0xd0 [iscsi_target_mod]\n iscsit_free_connection_recovery_entries+0x29d/0x320 [iscsi_target_mod]\n iscsit_close_session+0x13a/0x140 [iscsi_target_mod]\n iscsit_check_post_dataout+0x440/0x440 [iscsi_target_mod]\n call_timer_fn+0x24/0x140\n\nMove cleanup of recovery enrties to before session freeing."
          }
        ],
        "id": "CVE-2023-54184",
        "lastModified": "2026-08-04T11:16:35.567",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-12-30T13:16:06.357",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1911cca5916b6e106de7afa3ec0a38447158216c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4621e24c9257c6379343bf0c11b473817cf7edcd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4ce221d295f53e6c6b835ab33181e735482c9aac"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/89f5055f9b0b57c7e7f02e32df95ef401f809b71"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a7a4def6c7046e090bb10c6d550fdeb487db98ba"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d8990b5a4d065f38f35d69bcd627ec5a7f8330ca"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:53:57+00:00",
      "cve": "CVE-2023-54184",
      "id": "CVE-2023-54184",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "399",
      "product_status:known_affected": "66",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: scsi: target: iscsit: Free cmds before session free",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54184.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-10-02T00:25:56Z",
      "cve": "CVE-2023-54184",
      "id": "CVE-2023-54184",
      "initial_release_date": "2025-12-31T00:29:02Z",
      "product_status:known_affected": "716",
      "product_status:known_not_affected": "178",
      "product_status:recommended": "86",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-54184",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-54184.json",
      "version": "18"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.