В Linux- An gano rauni (CVE-2023-5178) a cikin tsarin nvmet-tcp (NVMe-oF/TCP), wanda ke ba da damar shiga na'urorin NVMe ta hanyar hanyar sadarwa (NVM Express over Fabrics) ta amfani da yarjejeniyar TCP. Wannan rauni yana iya ba da damar aiwatar da lambar nesa a matakin kernel ko, tare da samun dama ta gida, haɓaka gata a cikin tsarin. A halin yanzu akwai gyara a matsayin faci. Matsalar ta kasance tun lokacin sigar farko ta direban NVM-oF/TCP (rahoton rauni ya ambaci kernel). Linux 5.15, amma an ƙara tallafin NVMe-oF/TCP zuwa kernel 5.0). Tsarin da ke da NVMe-oF/TCP mai kunnawa suna da rauni ga rauni. uwar garken NVMe-oF/TCP (NVME_TARGET_TCP), wanda ta hanyar tsoho yana karɓar haɗi akan tashar sadarwa 4420.
Rashin lafiyar yana faruwa ne ta hanyar kuskuren ma'ana wanda aka kira aikin nvmet_tcp_free_crypto sau biyu kuma ya 'yantar da wasu masu nuni sau biyu, sannan kuma an soke adiresoshin da aka saki. Wannan halin yana haifar da samun dama ga wurin ƙwaƙwalwar ajiya da aka riga aka 'yanta (amfani-bayan-kyauta) da 'yantar da ƙwaƙwalwar ajiya sau biyu (kyauta biyu) lokacin da uwar garken NVMe-oF/TCP ke aiwatar da saƙon da aka tsara na musamman daga abokin ciniki, wanda za'a iya kasancewa duka biyun. a cikin gida da kuma na duniya cibiyar sadarwa.
source: budenet.ru
