{"id":"CVE-2023-53320","summary":"scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info()\n\nThe function mpi3mr_get_all_tgt_info() has four issues:\n\n1) It calculates valid entry length in alltgt_info assuming the header part\n   of the struct mpi3mr_device_map_info would equal to sizeof(u32).  The\n   correct size is sizeof(u64).\n\n2) When it calculates the valid entry length kern_entrylen, it excludes one\n   entry by subtracting 1 from num_devices.\n\n3) It copies num_device by calling memcpy(). Substitution is enough.\n\n4) It does not specify the calculated length to sg_copy_from_buffer().\n   Instead, it specifies the payload length which is larger than the\n   alltgt_info size. It causes \"BUG: KASAN: slab-out-of-bounds\".\n\nFix the issues by using the correct header size, removing the subtraction\nfrom num_devices, replacing the memcpy() with substitution and specifying\nthe correct length to sg_copy_from_buffer().","modified":"2026-04-02T09:43:59.526114Z","published":"2025-09-16T16:11:56.323Z","related":["SUSE-SU-2025:03615-1","SUSE-SU-2025:3761-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53320.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/2f3d3fa5b8ed7d3b147478f42b00b468eeb1ecd2"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8ba997b22f2cd5d29aad8c39f6201f7608ed0c04"},{"type":"WEB","url":"https://git.kernel.org/stable/c/fb428a2005fc1260d18b989cc5199f281617f44d"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53320.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53320"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"f5e6d5a343761081317c89d23489c93fbafc69ff"},{"fixed":"8ba997b22f2cd5d29aad8c39f6201f7608ed0c04"},{"fixed":"2f3d3fa5b8ed7d3b147478f42b00b468eeb1ecd2"},{"fixed":"fb428a2005fc1260d18b989cc5199f281617f44d"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53320.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}