NetSight
IP …
medium5.5

CVE-2023-53124

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() Port is allocated by…

Impact

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() Port is allocated by sas_port_alloc_num() and rphy is allocated by either sas_end_device_alloc() or sas_expander_alloc(), all of which may return NULL. So we need to check the rphy to avoid possible NULL pointer access. If sas_rphy_add() returned with failure, rphy is set to NULL. We would access the rphy in the following lines which would also result NULL pointer access.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 5.4.229 before 5.4.238
from 5.10.163 before 5.10.176
from 5.15.86 before 5.15.104
from 6.0.16 before 6.1
from 6.1.2 before 6.1.21
from 6.2 before 6.2.8

Weakness classification

CWE-476

References