In the Linux kernel, the following vulnerability has been resolved:
scsi: bsg: Cap io_uring sense copy to max_response_len
Completion copied scmd->sense_len to the user response buffer without
honoring max_response_len. After a valid sense, the midlayer sets
sense_len to the real length (up to SCSI_SENSE_BUFFERSIZE), so a smaller
user buffer was overrun.
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.8
AV:L - Reached only via IORING_OP_URING_CMD on a local /dev/bsg character device (bsg_fops.uring_cmd → bsg_uring_cmd → scsi_bsg_uring_cmd → scsi_bsg_uring_task_cb); per CNA guidance io_uring is Local, and no network or adjacent-radio path feeds SCSI sense completion.
AC:L - The attacker controls the CDB, response pointer, and claimed max_response_len, and can reliably force CHECK CONDITION with an illegal-field or out-of-range READ/INQUIRY/TEST_UNIT_READY so the midlayer sets sense_len up to SCSI_SENSE_BUFFERSIZE (96) and the uncapped copy_to_user runs with no race.
PR:L - bsg_open() has no capable() check and scsi_cmd_allowed() permits unprivileged read-class CDBs (INQUIRY, READ_*, TEST_UNIT_READY) without CAP_SYS_RAWIO; /dev/bsg nodes are routinely granted to disk/cdrom group members and uaccess-seated users on desktops, Android, and shared workstations.
UI:N - The attacker opens /dev/bsg and submits the io_uring command from their own process; no separate victim action such as mounting a filesystem or attaching hardware is required.
S:U - copy_to_user() writes past the caller-supplied userspace sense buffer in the submitting process and does not by itself corrupt kernel slab independently of that process or cross a VM, IOMMU, or sandbox boundary.
C:H - Completion ignores max_response_len and copies up to 96 bytes of sense into adjacent userspace, a heap/stack overflow that can be turned into an arbitrary-read primitive against a privileged bsg/io_uring consumer rather than a bounded disclosure of intended sense data.
I:H - scsi_bsg_uring_task_cb uses min(sense_len, SCSI_SENSE_BUFFERSIZE) instead of max_response_len, so a small user buffer is overrun by up to 96 bytes of sense, enabling adjacent heap/stack corruption and potential control-flow hijacking.
A:H - The out-of-bounds write can crash the calling process or a storage-management consumer using a traditional 18/32-byte sense buffer, and CHECK CONDITION commands can be repeated to induce process termination.
| Attack Vector |
Local |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
Low |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:L - Reached only via IORING_OP_URING_CMD on a local /dev/bsg character device (bsg_fops.uring_cmd → bsg_uring_cmd → scsi_bsg_uring_cmd → scsi_bsg_uring_task_cb); per CNA guidance io_uring is Local, and no network or adjacent-radio path feeds SCSI sense completion.
AC:L - The attacker controls the CDB, response pointer, and claimed max_response_len, and can reliably force CHECK CONDITION with an illegal-field or out-of-range READ/INQUIRY/TEST_UNIT_READY so the midlayer sets sense_len up to SCSI_SENSE_BUFFERSIZE (96) and the uncapped copy_to_user runs with no race.
PR:L - bsg_open() has no capable() check and scsi_cmd_allowed() permits unprivileged read-class CDBs (INQUIRY, READ_*, TEST_UNIT_READY) without CAP_SYS_RAWIO; /dev/bsg nodes are routinely granted to disk/cdrom group members and uaccess-seated users on desktops, Android, and shared workstations.
UI:N - The attacker opens /dev/bsg and submits the io_uring command from their own process; no separate victim action such as mounting a filesystem or attaching hardware is required.
S:U - copy_to_user() writes past the caller-supplied userspace sense buffer in the submitting process and does not by itself corrupt kernel slab independently of that process or cross a VM, IOMMU, or sandbox boundary.
C:H - Completion ignores max_response_len and copies up to 96 bytes of sense into adjacent userspace, a heap/stack overflow that can be turned into an arbitrary-read primitive against a privileged bsg/io_uring consumer rather than a bounded disclosure of intended sense data.
I:H - scsi_bsg_uring_task_cb uses min(sense_len, SCSI_SENSE_BUFFERSIZE) instead of max_response_len, so a small user buffer is overrun by up to 96 bytes of sense, enabling adjacent heap/stack corruption and potential control-flow hijacking.
A:H - The out-of-bounds write can crash the calling process or a storage-management consumer using a traditional 18/32-byte sense buffer, and CHECK CONDITION commands can be repeated to induce process termination.
CVSS 3.1