A Linux subsystem nvmet-tcp (NVMe-oF/TCP), which allows access to NVMe drives over the network (NVM Express over Fabrics) using the TCP protocol, has a vulnerability (CVE-2023-5178) that potentially allows remote execution of its code at the kernel level or, with local access, to escalate privileges in the system. A patch is currently available. The problem exists from the very first version of the NVMe-oF/TCP driver (the vulnerability report mentions Linux kernel 5.15, but support for NVMe-oF/TCP was added in kernel 5.0). Systems with enabled NVMe-oF/TCP (NVME_TARGET_TCP), which by default accepts connections on network port 4420, are vulnerable. szerverrel A vulnerability caused by a logical error in which the function nvmet_tcp_free_crypto was called twice and released certain pointers twice, as well as dereferencing freed addresses. Such behavior leads to accessing already released memory (use-after-free) and double memory release (double-free) when processing a specially crafted message from a client by the NVMe-oF/TCP server, which can be located in both local and global networks.
A vulnerability in the Linux subsystem nvmet-tcp (NVMe-oF/TCP), which allows access to NVMe drives over the network (NVM Express over Fabrics) using the TCP protocol, has been identified (CVE-2023-5178) that potentially allows remote execution.
Forrás: opennet.ru
