CVE-2023-53322

What it actually does

Use-after-free in the qla2xxx SCSI driver: terminate_rport_io can return before all pending IOs have been returned to the upper layer, allowing dev_loss_tmo-triggered resource freeing while the driver still holds references to FCP-2 hardware resources.

Why it matters to the business

Systems using QLogic Fibre Channel HBAs may experience kernel crashes and storage path failures during cable pulls or link events, leading to unplanned downtime and potential data access loss in SAN environments.

How an attack unfolds

An attacker with local or physical access induces repeated link flaps or cable pulls on FCP-2 devices to hang IOs in hardware; when the dev_loss_tmo timer fires, terminate_rport_io races with upper-layer freeing, resulting in a crash from the freed resource being accessed during final qla cleanup.

How to fix it

Update the Linux kernel to a version containing commit 8a55556cd7e0220486163b1285ce11a8be2ce5fa or apply the equivalent Debian package updates (screenie 1.30.0-5.1 on Debian 11-14). Reboot after installation and verify the qla2xxx module version.

How to confirm the fix worked

Confirm the running kernel contains the fix commit, reproduce link-flap scenarios with FCP-2 devices, and monitor for absence of use-after-free crashes in dmesg and kernel logs.

Typical attack path

1. Trigger link event or cable pull on FCP-2 target
2. Allow IOs to remain hung in qla2xxx hardware
3. Wait for dev_loss_tmo expiration
4. Invoke terminate_rport_io while upper layer frees structures
5. Driver accesses freed resources during cleanup

How to detect it

Search kernel logs and crash dumps for qla2xxx terminate_rport_io activity around dev_loss_tmo events and use-after-free signatures; correlate with FCP-2 device link-down events.

• qla2xxx.*terminate_rport_io
• dev_loss_tmo
• use after free.*qla
• FCP-2.*IO hang

What your security team should do

• Apply the kernel fix immediately on any systems with QLogic HBAs
• Prioritize hosts in production SAN fabrics
• Add kernel crash and qla2xxx error logging to monitoring
• Test storage failover paths after patching