CVE-2023-54102

Vulnerability

In the Linux kernel's SCSI lpfc driver, the function lpfc_debugfs_lockstat_write() is used to handle writes to a debugfs entry. A static code analysis tool identified that copy_from_user() could copy more bytes than the size of the local buffer mybuf, leading to a buffer overflow. The fix adds a min() restriction to ensure that the number of bytes copied is limited to sizeof(mybuf) - 1 [1][2][3].

Exploitation

An attacker with local access and the ability to write to the debugfs file system could trigger this overflow by providing a large input. No special privileges beyond the ability to write to debugfs are required, as the debugfs entry is typically accessible to unprivileged users in some configurations.

Impact

A successful buffer overflow could corrupt kernel memory, potentially leading to a denial of service (system crash) or, in some cases, privilege escalation. The vulnerability is considered moderate severity.

Mitigation

The fix has been applied to the Linux kernel stable branches. Users should update to a kernel version containing the commit that adds the min() restriction. No workaround is available other than restricting access to debugfs.