CVE-2023-53320

What it actually does

Incorrect header size assumption (u32 instead of u64), erroneous subtraction from num_devices, memcpy misuse, and oversized length passed to sg_copy_from_buffer in mpi3mr_get_all_tgt_info cause slab-out-of-bounds writes in the kernel SCSI driver.

Why it matters to the business

Kernel memory corruption can lead to system crashes, denial of service, or potential privilege escalation on Linux systems using the mpi3mr driver; low exploit prevalence reduces immediate widespread risk but requires prompt patching.

How an attack unfolds

An attacker supplies crafted device map information that triggers mpi3mr_get_all_tgt_info, exploiting the miscalculated entry lengths and buffer copy to perform out-of-bounds memory access.

How to fix it

Upgrade the Linux kernel to commit 8ba997b22f2cd5d29aad8c39f6201f7608ed0c04 or later; apply the corrected header size, remove the erroneous subtraction, replace memcpy with assignment, and pass the proper length to sg_copy_from_buffer.

How to confirm the fix worked

Verify kernel version includes the referenced commit; monitor kernel logs for absence of KASAN slab-out-of-bounds reports during mpi3mr target info operations.

Typical attack path

1. Initiate SCSI target enumeration operations that invoke mpi3mr_get_all_tgt_info
2. Supply device information that exercises the flawed length calculations
3. Trigger sg_copy_from_buffer with oversized payload to corrupt adjacent kernel slab memory

How to detect it

Search kernel logs and dmesg for KASAN slab-out-of-bounds reports mentioning mpi3mr_get_all_tgt_info; correlate with SCSI target enumeration events.

• BUG: KASAN: slab-out-of-bounds
• mpi3mr_get_all_tgt_info

What your security team should do

• Prioritize kernel updates on systems using mpi3mr hardware
• Enable KASAN or similar memory debugging in test environments to validate the fix
• Review logs for prior slab-out-of-bounds indicators even though KEV status is false