Linux kernel NVMe target authentication (nvmet-auth DH group setup): Ctrl

Impact

Ctrl->dh_key is freed on the error path of nvmet_setup_dhgroup() but not nulled, and it survives across repeated calls for the same controller, so nvmet_destroy_auth() frees it a second time. The bug lives in the DH-HMAC-CHAP negotiation - the code that decides whether a connecting initiator is who it claims to be - and a remote initiator drives it by repeating a failing DH group negotiation. Corrupting the heap from inside the authentication handshake is the worst possible place for it, because it is reachable before the handshake grants anything.

Who can reach it

Remote, pre-authentication. An initiator repeatedly negotiates an invalid DH group against the target.

What to do

Kernel update nulling dh_key after kfree_sensitive(). If in-band authentication is not required on a given subsystem, disabling DH-HMAC-CHAP removes the path; if it is required, patch the target nodes before widening initiator reachability.

References