CVE-2024-42152

Summary

In the Linux kernel, the following vulnerability has been resolved:

nvmet: fix a possible leak when destroy a ctrl during qp establishment

In nvmet_sq_destroy we capture sq->ctrl early and if it is non-NULL we know that a ctrl was allocated (in the admin connect request handler) and we need to release pending AERs, clear ctrl->sqs and sq->ctrl (for nvme-loop primarily), and drop the final reference on the ctrl.

However, a small window is possible where nvmet_sq_destroy starts (as a result of the client giving up and disconnecting) concurrently with the nvme admin connect cmd (which may be in an early stage). But before kill_and_confirm of sq->ref (i.e. the admin connect managed to get an sq live reference). In this case, sq->ctrl was allocated however after it was captured in a local variable in nvmet_sq_destroy. This prevented the final reference drop on the ctrl.

Solve this by re-capturing the sq->ctrl after all inflight request has completed, where for sure sq->ctrl reference is final, and move forward based on that.

This issue was observed in an environment with many hosts connecting multiple ctrls simoutanuosly, creating a delay in allocating a ctrl leading up to this race window.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux0f5be6a4ff7b3f8bf3db15f904e3e76797a43d9a < 2f3c22b1d3d7e86712253244797a651998c141faaffected
LinuxLinux0f5be6a4ff7b3f8bf3db15f904e3e76797a43d9a < b4fed1443a6571d49c6ffe7d97af3bbe5ee6dff5affected
LinuxLinux0f5be6a4ff7b3f8bf3db15f904e3e76797a43d9a < 940a71f08ef153ef807f751310b0648d1fa5d0daaffected
LinuxLinux0f5be6a4ff7b3f8bf3db15f904e3e76797a43d9a < 5502c1f1d0d7472706cc1f201aecf1c935d302d1affected
LinuxLinux0f5be6a4ff7b3f8bf3db15f904e3e76797a43d9a < 818004f2a380420c19872171be716174d4985e33affected
LinuxLinux0f5be6a4ff7b3f8bf3db15f904e3e76797a43d9a < c758b77d4a0a0ed3a1292b3fd7a2aeccd1a169a4affected
LinuxLinux5.6affected
LinuxLinux0 < 5.6unaffected
LinuxLinux5.10.222 <= 5.10.*unaffected
LinuxLinux5.15.163 <= 5.15.*unaffected
LinuxLinux6.1.98 <= 6.1.*unaffected
LinuxLinux6.6.39 <= 6.6.*unaffected
LinuxLinux6.9.9 <= 6.9.*unaffected
LinuxLinux6.10 <= *unaffected

Weaknesses

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References