Linux kernel - NVMe-oF target DH-HMAC-CHAP authentication, drivers/nvme/target/fabrics-cmd-auth.c: TENANT ISOLATION

Impact

TENANT ISOLATION: The sibling of the previous finding and worse - this one writes. nvmet_execute_auth_receive() trusted the AUTH_RECEIVE allocation length after checking only that it was non-zero, so a remote initiator supplying a one-byte allocation length reaches the fixed-size response builders with an undersized buffer and triggers a 16-byte heap out-of-bounds write. The code merely warned about the short length and then formatted the response anyway. A controlled heap write from a remote peer on a storage node is a direct path to kernel code execution and thus to every tenant volume the target serves.

Who can reach it

A remote NVMe-oF initiator with access to an auth-enabled target sends an AUTH_RECEIVE with a one-byte allocation length while the exchange is in the SUCCESS1 or FAILURE1 state. Reachable only when in-band DH-HMAC-CHAP is configured - so again, this is a risk you take on by following the standard hardening advice on an unpatched kernel.

What to do

Host reboot / kernel upgrade on NVMe-oF targets. Patch before enabling DH-HMAC-CHAP; if auth is already on and the kernel is unpatched, treat the upgrade as urgent and restrict target reachability to known initiators at the firewall in the meantime. Roll targets in waves with multipath initiators so tenants see no I/O interruption.

References