CVE-2023-53320: scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info()

Vulnerability summary

CVE-2023-53320 is a high (CVSS 7.8) Out-of-bounds Write vulnerability in linux. EPSS estimates a 0.15% chance of exploitation in the next 30 days, higher than 4.5% of scored vulnerabilities.

Timeline

1. 16-09-2025
   PublishedVulnerability first disclosed.
2. 11-05-2026
   Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info() The function mpi3mr_get_all_tgt_info() has four issues: 1) It calculates valid entry length in alltgt_info assuming the header part of the struct mpi3mr_device_map_info would equal to sizeof(u32). The correct size is sizeof(u64). 2) When it calculates the valid entry length kern_entrylen, it excludes one entry by subtracting 1 from num_devices. 3) It copies num_device by calling memcpy(). Substitution is enough. 4) It does not specify the calculated length to sg_copy_from_buffer(). Instead, it specifies the payload length which is larger than the alltgt_info size. It causes "BUG: KASAN: slab-out-of-bounds". Fix the issues by using the correct header size, removing the subtraction from num_devices, replacing the memcpy() with substitution and specifying the correct length to sg_copy_from_buffer().

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.