High · published February 23, 2024
In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length
If the host sends an H2CData command with an invalid DATAL,
the kernel may crash in nvmet_tcp_build_pdu_iovec().
Unable to handle kernel NULL pointer dereference at
virtual address 0000000000000000
lr : nvmet_tcp_io_work+0x6ac/0x718 [nvmet_tcp]
Call trace:
process_one_work+0x174/0x3c8
worker_thread+0x2d0/0x3e8
kthread+0x104/0x110
Fix the bug by raising a fatal error if DATAL isn't coherent
with the packet size.
Also, the PDU length should never exceed the MAXH2CDATA parameter which
has been communicated to the host in nvmet_tcp_handle_icreq().
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 5.0.0, < 5.4.268 | 5.4.268 |
| linux/linux_kernel | ≥ 5.5.0, < 5.10.209 | 5.10.209 |
| linux/linux_kernel | ≥ 5.11.0, < 5.15.148 | 5.15.148 |
| linux/linux_kernel | ≥ 5.16.0, < 6.1.75 | 6.1.75 |
| linux/linux_kernel | ≥ 6.2.0, < 6.6.14 | 6.6.14 |
| linux/linux_kernel | ≥ 6.7.0, < 6.7.2 | 6.7.2 |