CVE-2023-52454: nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length
In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length
If the host sends an H2CData command with an invalid DATAL, the kernel may crash in nvmettcpbuildpduiovec().
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 lr : nvmettcpiowork+0x6ac/0x718 [nvmettcp] Call trace: processonework+0x174/0x3c8 workerthread+0x2d0/0x3e8 kthread+0x104/0x110
Fix the bug by raising a fatal error if DATAL isn't coherent with the packet size. Also, the PDU length should never exceed the MAXH2CDATA parameter which has been communicated to the host in nvmettcphandleicreq().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52454?
CVE-2023-52454 has a severity rating that indicates it can lead to a kernel panic due to an invalid H2C PDU length.
How do I fix CVE-2023-52454?
To fix CVE-2023-52454, update the Linux kernel to a version that is not affected, such as 5.10.223-1 or higher.
Which versions of the Linux kernel are affected by CVE-2023-52454?
CVE-2023-52454 affects Linux kernel versions from 5.0.0 to 5.4.268, 5.5.0 to 5.10.209, 5.11.0 to 5.15.148, 5.16.0 to 6.1.75, and 6.2.0 to 6.6.14.
What could happen if CVE-2023-52454 is exploited?
Exploitation of CVE-2023-52454 could result in a kernel panic, causing the system to crash and potentially leading to service disruption.
Is there a workaround for CVE-2023-52454?
There are no specific workarounds for CVE-2023-52454, so the best approach is to apply the recommended kernel updates.