CVE-2024-45013: nvme: move stopping keep-alive into nvme_uninit_ctrl()
In the Linux kernel, the following vulnerability has been resolved:
nvme: move stopping keep-alive into nvmeuninitctrl()
Commit 4733b65d82bd ("nvme: start keep-alive after admin queue setup") moves starting keep-alive from nvmestartctrl() into nvmeinitctrlfinish(), but don't move stopping keep-alive into nvmeuninitctrl(), so keep-alive work can be started and keep pending after failing to start controller, finally use-after-free is triggered if nvme host driver is unloaded.
This patch fixes kernel panic when running nvme/004 in case that connection failure is triggered, by moving stopping keep-alive into nvmeuninitctrl().
This way is reasonable because keep-alive is now started in nvmeinitctrlfinish().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 4733b65d82bd - Compensating control
Apply the kernel patch that moves NVMe keep-alive shutdown into nvme_uninit_ctrl() to prevent a use-after-free/kernel panic when the NVMe controller fails to start (e.g., during the scenario referenced as nvme/004 and connection failure).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45013?
CVE-2024-45013 has a medium severity rating due to the impact on system stability during NVMe controller management.
How do I fix CVE-2024-45013?
To mitigate CVE-2024-45013, upgrade to a patched version of the Linux Kernel, such as 5.10.223-1, 6.1.123-1, or later.
Which versions of the Linux Kernel are affected by CVE-2024-45013?
CVE-2024-45013 affects Linux Kernel versions from 6.7 up to and including 6.10.7, and several 6.11 release candidates.
What was the cause of CVE-2024-45013?
CVE-2024-45013 was caused by the incorrect handling of the NVMe controller's keep-alive operation during initialization.
Is CVE-2024-45013 present in Debian Linux distributions?
Yes, CVE-2024-45013 can affect Debian Linux distributions running on the vulnerable versions of the Linux Kernel.