CVE-2023-52975 is a high-severity use-after-free (UAF) vulnerability identified in the Linux kernel's iSCSI TCP transport layer. The flaw occurs during the iSCSI session logout process, specifically when accessing the SCSI host's (shost) IP address attribute. The vulnerability arises because if another task accesses the shost ipaddress attribute concurrently during logout, it can trigger a use-after-free condition. This is detected by Kernel Address Sanitizer (KASAN) as an invalid memory access, potentially leading to kernel crashes or arbitrary code execution. The vulnerability is rooted in improper synchronization and memory management within the iscsi_tcp module, where the session teardown frees resources that may still be accessed by other tasks. The kernel log excerpts show detailed stack traces indicating the UAF triggered in the _raw_spin_lock_bh function, with the use of iscsi_tcp and scsi_transport_iscsi modules. The vulnerability is tracked as CWE-416 (Use After Free) and has been assigned a CVSS v3.1 score of 7.8, reflecting high impact on confidentiality, integrity, and availability. Exploitation requires local privileges (AV:L), low attack complexity (AC:L), and privileges (PR:L), but no user interaction (UI:N). No known exploits are currently reported in the wild. The vulnerability affects Linux kernel versions containing the iscsi_tcp transport implementation, which is widely used in enterprise environments for storage networking over IP. The patch details are not provided in the source, but the issue has been resolved in recent kernel updates. This vulnerability could be leveraged by a local attacker or malicious process to escalate privileges, cause denial of service, or potentially execute arbitrary code in kernel context by exploiting the use-after-free condition during iSCSI session logout.

For European organizations, this vulnerability poses a significant risk especially to enterprises relying on Linux-based servers and storage infrastructure utilizing iSCSI for SAN (Storage Area Network) connectivity. The use-after-free flaw can lead to kernel crashes causing denial of service, impacting availability of critical services. More critically, it could allow local attackers or compromised processes to escalate privileges to kernel level, threatening confidentiality and integrity of sensitive data. Organizations in sectors such as finance, healthcare, telecommunications, and government, which often deploy Linux servers with iSCSI storage, may face operational disruptions and data breaches if exploited. The impact is heightened in virtualized environments (e.g., VMware) where multiple tenants share hardware, increasing the attack surface. Given the low complexity of exploitation and absence of required user interaction, the vulnerability could be exploited by insiders or malware with limited privileges. The lack of known exploits in the wild currently reduces immediate risk but patching is urgent to prevent future exploitation. Failure to address this vulnerability could lead to compliance violations under GDPR and other data protection regulations due to potential unauthorized access or data loss.

European organizations should prioritize updating Linux kernels to versions where CVE-2023-52975 is patched. Since the vulnerability resides in the iscsi_tcp kernel module, kernel updates from trusted Linux distributions (e.g., Debian, Ubuntu, Red Hat, SUSE) should be applied promptly. Organizations using custom or embedded Linux kernels must backport the fix or upgrade accordingly. Additionally, auditing and restricting local user privileges can reduce exploitation risk, as the vulnerability requires local access with some privileges. Monitoring kernel logs for KASAN or related error messages can help detect attempted exploitation or unstable systems. Disabling iSCSI TCP transport temporarily may be considered in environments where iSCSI is not critical, to mitigate exposure. Implementing strict access controls and isolating critical storage networks can limit attacker movement. Regular vulnerability scanning and penetration testing should include checks for this vulnerability. Finally, organizations should maintain incident response readiness to quickly address any exploitation attempts.