CVE-2023-52974

Summary

CVE-2023-52974 is a use-after-free vulnerability affecting the Linux kernel's scsi subsystem (iscsi_tcp). During the creation of an iSCSI TCP session, if iscsi_tcp_r2tpool_alloc() fails and userspace is still accessing the session, attempting to tear down the session via iscsi_session_teardown() will result in a use-after-free condition. This issue could allow unauthorized access to the host's IP address. To mitigate this vulnerability, the Linux kernel has been updated to set the tcp_sw_host->session after session creation is complete and no longer subject to failure.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.