Fix regression in data_digest calculation in nvmet-tcp
Summary
GSD-2022-1004224: nvmet-tcp: fix regression in data_digest calculation. Affects Kernel versions >= 69b85e1f1d1d1e49601ec3e85d2031188657cca2, < 5a11a5e485d88aeea5edcb80113e282f29ae2145. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The nvmet-tcp package is a component of the Linux Kernel ecosystem. It provides support for the NVMe over TCP protocol, allowing remote access to NVMe storage devices over a TCP/IP network. This package is responsible for handling data_digest calculation in the NVMe over TCP protocol. The data_digest calculation ensures the integrity of data transferred between the client and the NVMe storage device. However, a regression in the data_digest calculation has been identified, potentially leading to data integrity issues.
Vulnerability Detail
The regression in the data_digest calculation in nvmet-tcp can result in incorrect data_digest values being calculated. This can lead to data integrity issues, as the client and the NVMe storage device may have mismatched data_digest values. An attacker could potentially exploit this vulnerability to modify data during transmission without detection. This vulnerability was introduced in version v5.16 of the Linux Kernel and has been fixed in version v5.18.10.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The regression in the data_digest calculation in nvmet-tcp can lead to data integrity issues when transferring data between the client and the NVMe storage device. It is crucial to update the Linux Kernel to version v5.18.10 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
nvmet-tcp is a component of the Linux Kernel that enables remote access to NVMe storage devices over a TCP/IP network.
Data_digest calculation is a process in the NVMe over TCP protocol that ensures the integrity of data transferred between the client and the NVMe storage device.
This vulnerability can result in data integrity issues, as the client and the NVMe storage device may have mismatched data_digest values. An attacker could potentially modify data during transmission without detection.
To fix this vulnerability, update the Linux Kernel to version v5.18.10 or later, which includes the necessary fix for the data_digest calculation regression.
This vulnerability was introduced in version v5.16 of the Linux Kernel and has been fixed in version v5.18.10.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
