https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 14:57:10 +0000 https://db.gcve.eu/vuln/cve-2023-53320 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info()</p> <p>The function mpi3mr_get_all_tgt_info() has four issues:</p> <p>1) It calculates valid entry length in alltgt_info assuming the header part of the struct mpi3mr_device_map_info would equal to sizeof(u32). The correct size is sizeof(u64).</p> <p>2) When it calculates the valid entry length kern_entrylen, it excludes one entry by subtracting 1 from num_devices.</p> <p>3) It copies num_device by calling memcpy(). Substitution is enough.</p> <p>4) It does not specify the calculated length to sg_copy_from_buffer(). Instead, it specifies the payload length which is larger than the alltgt_info size. It causes &#34;BUG: KASAN: slab-out-of-bounds&#34;.</p> <p>Fix the issues by using the correct header size, removing the subtraction from num_devices, replacing the memcpy() with substitution and specifying the correct length to sg_copy_from_buffer().</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info()</p> <p>The function mpi3mr_get_all_tgt_info() has four issues:</p> <p>1) It calculates valid entry length in alltgt_info assuming the header part of the struct mpi3mr_device_map_info would equal to sizeof(u32). The correct size is sizeof(u64).</p> <p>2) When it calculates the valid entry length kern_entrylen, it excludes one entry by subtracting 1 from num_devices.</p> <p>3) It copies num_device by calling memcpy(). Substitution is enough.</p> <p>4) It does not specify the calculated length to sg_copy_from_buffer(). Instead, it specifies the payload length which is larger than the alltgt_info size. It causes &#34;BUG: KASAN: slab-out-of-bounds&#34;.</p> <p>Fix the issues by using the correct header size, removing the subtraction from num_devices, replacing the memcpy() with substitution and specifying the correct length to sg_copy_from_buffer().</p> https://db.gcve.eu/vuln/cve-2023-53320