CVE-2024-45013CWE-416

CVE-2024-45013

Critical · published September 11, 2024

CVSS v3.1
9.8
EPSS
0%
Percentile
30.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

nvme: move stopping keep-alive into nvme_uninit_ctrl()

Commit 4733b65d82bd ("nvme: start keep-alive after admin queue setup")

moves starting keep-alive from nvme_start_ctrl() into

nvme_init_ctrl_finish(), but don't move stopping keep-alive into

nvme_uninit_ctrl(), so keep-alive work can be started and keep pending

after failing to start controller, finally use-after-free is triggered if

nvme host driver is unloaded.

This patch fixes kernel panic when running nvme/004 in case that connection

failure is triggered, by moving stopping keep-alive into nvme_uninit_ctrl().

This way is reasonable because keep-alive is now started in

nvme_init_ctrl_finish().

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00379 · 30.6th percentile
Weakness
CWE-416 · Use After Free
Published
2024-09-11T20:15Z
Affected products (5)
ProductVersionsFixed in
linux/linux_kernel≥ 6.7, < 6.10.76.10.7
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (2)
EPSS history
Timeline
  • 11 SEP 15:13Z
    nvme: move stopping keep-alive into nvme_uninit_ctrl()
    cvelistv5