Database/Kernel, userspace & hypervisor
Linux kernel - NVMe-oF TCP target, drivers/nvme/target/tcp.c: A host sending an H2CData command with a DATAL
Impact
A host sending an H2CData command with a DATAL inconsistent with the packet size drives a NULL pointer dereference in nvmet_tcp_build_pdu_iovec() and panics the target kernel. The PDU length was also never checked against the MAXH2CDATA value the target itself advertised during connection setup. On a storage node serving many GPU tenants, one malformed PDU from one tenant takes the node down and every attached volume with it - and since NVMe/TCP is unauthenticated by default, the attacker does not need to be a tenant at all, just reachable.
Who can reach it
Connect to the NVMe/TCP target and send an H2CData PDU whose DATAL does not match the actual packet size, or which exceeds the negotiated MAXH2CDATA. Trivial to construct, instantly fatal to the target, and repeatable after every reboot until patched.
What to do
Host reboot / kernel upgrade on nvmet-tcp targets. Interim: restrict port 4420 to known initiator addresses and enable in-band authentication (on a patched kernel) so an arbitrary peer cannot reach the PDU parser. If a storage node is serving production tenants and cannot be rebooted immediately, the firewall restriction is the meaningful control - this is remotely triggerable with no state.
References
Related entries
- Linux kernel - NVMe-oF TCP target, drivers/nvme/target/tcp.c: The NVMe/TCP target used the host-supplied Transfer TagCVE-2022-50717 · Linux kernel - NVMe-oF TCP target, drivers/nvme/target/tcp.cCritical
- Linux kernel (net/tls): A receiver that holds its TCP window at zero keeps the kTLS sender blocked inside tx_lockCVE-2023-54306 · Linux kernel (net/tls)High
- Xen (x86 speculation): Incorrect logic for BTC/SRSO mitigationsCVE-2024-31142 · Xen (x86 speculation)High
- AMD CPU (EntrySign): Improper signature verification in the AMD CPU microcode patch loaderCVE-2024-36347 · AMD CPU (EntrySign)High
- VMware vCenter: Privilege escalation to root on vCenter via a crafted network packetCVE-2024-38813 · VMware vCenterHigh
- Linux kernel NVMe target core (controller teardown racing queue-pair establishment): An initiator that disconnectsCVE-2024-42152 · Linux kernel NVMe target core (controller teardown racing queue-pair establishment)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.