scsi: storvsc: Fix handling of virtual Fibre Channel timeouts
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 8 fixed, 4 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-476.
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Fix handling of virtual Fibre Channel timeouts Hyper-V provides the ability to connect Fibre Channel LUNs to the host system and present them in a guest VM as a SCSI device. I/O to the vFC device is handled by the storvsc driver. The storvsc driver includes a partial integration with the FC transport implemented in the generic portion of the Linux SCSI subsystem so that FC attributes can be displayed in /sys. However, the partial integration means that some aspects of vFC don't work properly. Unfortunately, a full and correct integration isn't practical because of limitations in what Hyper-V provides to the guest. In particular, in the context of Hyper-V storvsc, the FC transport timeout function fc_eh_timed_out() causes a kernel panic because it can't find the rport and dereferences a NULL pointer. The original patch that added the call from storvsc_eh_timed_out() to fc_eh_timed_out() is faulty in this regard. In many cases a timeout is due to a transient condition, so the situation can be improved by just continuing to wait like with other I/O requests issued by storvsc, and avoiding the guaranteed panic. For a permanent failure, continuing to wait may result in a hung thread instead of a panic, which again may be better. So fix the panic by removing the storvsc call to fc_eh_timed_out(). This allows storvsc to keep waiting for a response. The change has been tested by users who experienced a panic in fc_eh_timed_out() due to transient timeouts, and it solves their problem. In the future we may want to deprecate the vFC functionality in storvsc since it can't be fully fixed. But it has current users for whom it is working well enough, so it should probably stay for a while longer.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Linux | Linux | 4.13 and later | 4.14.323, 4.19.292, 5.4.254, 5.10.191, 5.15.127, 6.1.46, 6.4.11, 6.5 | Patch available | CNA |
- Linux VendorLinux Affected 4.13 and later Fixed in 4.14.323, 4.19.292, 5.4.254, 5.10.191, 5.15.127, 6.1.46, 6.4.11, 6.5 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 4.13 to before 4.14.323; 4.15 to before 4.19.292; 4.20 to before 5.4.254; 5.5 to before 5.10.191; 5.11 to before 5.15.127; 5.16 to before 6.1.46; 6.2 to before 6.4.11 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:6.5:rc1:*:*:*:*:*:* | 6.5 rc1 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:6.5:rc2:*:*:*:*:*:* | 6.5 rc2 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:6.5:rc3:*:*:*:*:*:* | 6.5 rc3 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:6.5:rc4:*:*:*:*:*:* | 6.5 rc4 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:6.5:rc5:*:*:*:*:*:* | 6.5 rc5 | Vulnerable | Linux |
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 4.13 to before 4.14.323; 4.15 to before 4.19.292; 4.20 to before 5.4.254; 5.5 to before 5.10.191; 5.11 to before 5.15.127; 5.16 to before 6.1.46; 6.2 to before 6.4.11 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:6.5:rc1:*:*:*:*:*:* Versions 6.5 rc1 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:6.5:rc2:*:*:*:*:*:* Versions 6.5 rc2 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:6.5:rc3:*:*:*:*:*:* Versions 6.5 rc3 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:6.5:rc4:*:*:*:*:*:* Versions 6.5 rc4 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:6.5:rc5:*:*:*:*:*:* Versions 6.5 rc5 Vulnerable ·Linux
Remediation
- Fix · CNA Linux (Linux) Fixed in 4.14.323, 4.19.292, 5.4.254, 5.10.191, 5.15.127, 6.1.46, 6.4.11, 6.5
Red Hat 4 advisories
- RHSA-2023:7077 Released 2023-11-14 · Red Hat rating Importantkernel security, bug fix, and enhancement update
- Red Hat CodeReady Linux Builder (v. 8) kernel-tools-libs-devel-4.18.0-513.5.1.el8_9
- Red Hat Enterprise Linux BaseOS (v. 8) bpftool-4.18.0-513.5.1.el8_9, kernel-4.18.0-513.5.1.el8_9, kernel-abi-stablelists-4.18.0-513.5.1.el8_9 +19
- RHSA-2023:6583 Released 2023-11-07 · Red Hat rating Importantkernel security, bug fix, and enhancement update
- Red Hat CodeReady Linux Builder (v. 9) kernel-tools-libs-devel-5.14.0-362.8.1.el9_3, libperf-5.14.0-362.8.1.el9_3
- Red Hat Enterprise Linux AppStream (v. 9) kernel-64k-debug-devel-5.14.0-362.8.1.el9_3, kernel-64k-debug-devel-matched-5.14.0-362.8.1.el9_3, kernel-64k-devel-5.14.0-362.8.1.el9_3 +11
- Red Hat Enterprise Linux BaseOS (v. 9) bpftool-7.2.0-362.8.1.el9_3, kernel-5.14.0-362.8.1.el9_3, kernel-64k-5.14.0-362.8.1.el9_3 +29
- Red Hat Enterprise Linux Real Time (v. 9) kernel-rt-5.14.0-362.8.1.el9_3, kernel-rt-core-5.14.0-362.8.1.el9_3, kernel-rt-debug-5.14.0-362.8.1.el9_3 +9
- Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt-5.14.0-362.8.1.el9_3, kernel-rt-core-5.14.0-362.8.1.el9_3, kernel-rt-debug-5.14.0-362.8.1.el9_3 +11
- RHSA-2023:5627 Released 2023-10-10 · Red Hat rating Importantkernel security, bug fix, and enhancement update
- Red Hat CodeReady Linux Builder EUS (v.8.6) kernel-tools-libs-devel-4.18.0-372.75.1.el8_6
- Red Hat Enterprise Linux BaseOS EUS (v.8.6) bpftool-4.18.0-372.75.1.el8_6, kernel-4.18.0-372.75.1.el8_6, kernel-abi-stablelists-4.18.0-372.75.1.el8_6 +19
- Red Hat Virtualization 4 Hypervisor for RHEL 8 kernel-devel-4.18.0-372.75.1.el8_6, perf-4.18.0-372.75.1.el8_6
Show 1 more Red Hat advisories
- RHSA-2023:5604 Released 2023-10-10 · Red Hat rating Importantkernel security and bug fix update
- Red Hat CodeReady Linux Builder EUS (v.9.0) kernel-tools-libs-devel-5.14.0-70.75.1.el9_0
- Red Hat Enterprise Linux AppStream EUS (v.9.0) kernel-debug-devel-5.14.0-70.75.1.el9_0, kernel-debug-devel-matched-5.14.0-70.75.1.el9_0, kernel-devel-5.14.0-70.75.1.el9_0 +5
- Red Hat Enterprise Linux BaseOS EUS (v.9.0) bpftool-5.14.0-70.75.1.el9_0, kernel-5.14.0-70.75.1.el9_0, kernel-abi-stablelists-5.14.0-70.75.1.el9_0 +14
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat CodeReady Linux Builder (v. 8) | Fixed | RHSA-2023:7077 |
| Red Hat CodeReady Linux Builder EUS (v.8.6) | Fixed | RHSA-2023:5627 |
| Red Hat CodeReady Linux Builder EUS (v.9.0) | Fixed | RHSA-2023:5604 |
| Red Hat Enterprise Linux AppStream EUS (v.9.0) | Fixed | RHSA-2023:5604 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2023:7077 |
| Red Hat Enterprise Linux BaseOS EUS (v.8.6) | Fixed | RHSA-2023:5627 |
| Red Hat Enterprise Linux BaseOS EUS (v.9.0) | Fixed | RHSA-2023:5604 |
| Red Hat Virtualization 4 Hypervisor for RHEL 8 | Fixed | RHSA-2023:5627 |
Not affected: 1 product
- Red Hat Enterprise Linux 10
Timeline
- 2026-10-02 Threatist record created from CVE-2023-53245
- 2026-10-03 Alias added: GHSA-3xmr-hc67-565w
References
Patch 8
- https://git.kernel.org/stable/c/cd87f4df9865a53807001ed12c0f0420b14ececd
- https://git.kernel.org/stable/c/311db605e07f0d4fc0cc7ddb74f1e5692ea2f469
- https://git.kernel.org/stable/c/048ebc9a28fb918ee635dd4b2fcf4248eb6e4050
- https://git.kernel.org/stable/c/1678408d08f31a694d5150a56796dd04c9710b22
- https://git.kernel.org/stable/c/7a792b3d888aab2c65389f9f4f9f2f6c000b1a0d
- https://git.kernel.org/stable/c/ed70fa5629a8b992a5372d7044d1db1f8fa6de29
- https://git.kernel.org/stable/c/763c06565055ae373fe7f89c11e1447bd1ded264
- https://git.kernel.org/stable/c/175544ad48cbf56affeef2a679c6a4d4fb1e2881
More Linux Kernel vulnerabilities
- TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
- TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
- TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
- TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
- TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
- TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
Sources
- CVE-2023-53245 · CVE Program
- CVE-2023-53245 · NVD
- FIRST EPSS
- GHSA-3xmr-hc67-565w · GitHub Advisory Database · CC BY 4.0
- CVE-2023-53245 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences