Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-52980

In the Linux kernel, the following vulnerability has been resolved: block: ublk: extending queue_size to fix overflow When validating drafted SPDK ublk target, in a case that assigning large queue depth to multiqueue ublk device, ublk target would run into a weird incorrect state. During rounds of review and debug, An overflow bug was found in ublk driver. In ublk_cmd.h, UBLK_MAX_QUEUE_DEPTH is 4096 which means each ublk queue depth can be set as large as 4096. But when setting qd for a ublk device, sizeof(struct ublk_queue) + depth * sizeof(struct ublk_io) will be larger than 65535 if qd is larger than 2728. Then queue_size is overflowed, and ublk_get_queue() references a wrong pointer position. The wrong content of ublk_queue elements will lead to out-of-bounds memory access. Extend queue_size in ublk_device as "unsigned int".

Published

2025-03-27T17:15:45.183

Last Modified

2025-10-28T18:23:45.827

Status

Analyzed

Source

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity

CVSSv3.1: 7.8 (HIGH)

Weaknesses
  • Type: Primary
    CWE-787
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System linux linux_kernel < 6.1.11 Yes
Operating System linux linux_kernel 6.2 Yes
Operating System linux linux_kernel 6.2 Yes
Operating System linux linux_kernel 6.2 Yes
Operating System linux linux_kernel 6.2 Yes
Operating System linux linux_kernel 6.2 Yes
Operating System linux linux_kernel 6.2 Yes
References