Use-After-Free Vulnerability in nvme-tcp
Summary
GSD-2022-1000457: nvme-tcp: fix possible use-after-free in transport error_recovery work. Affects Kernel versions < 5e42fca37ccc76f39f73732661bd47254cad5982. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The nvme-tcp package is a component of the Linux Kernel, which is responsible for handling NVMe over TCP transport. NVMe (Non-Volatile Memory Express) is a protocol designed for accessing solid-state drives (SSDs) over a PCI Express (PCIe) bus. The nvme-tcp package provides the necessary functionality for NVMe devices to communicate with the kernel over a TCP/IP network. This vulnerability affects the nvme-tcp package and can potentially lead to a use-after-free issue in the transport error_recovery work.
Vulnerability Detail
The use-after-free vulnerability in the nvme-tcp package occurs when the transport error_recovery work is executed. This vulnerability could allow an attacker to exploit a freed memory region, leading to a potential crash or arbitrary code execution. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in Linux Kernel version v5.15.25 by commit 5e42fca37ccc76f39f73732661bd47254cad5982.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The use-after-free vulnerability in the nvme-tcp package can potentially lead to crashes or arbitrary code execution. It is crucial to update the Linux Kernel to version v5.15.25 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The nvme-tcp package is a component of the Linux Kernel that enables NVMe devices to communicate with the kernel over a TCP/IP network.
A use-after-free vulnerability occurs when a program continues to use a memory region after it has been freed. This can lead to crashes, memory corruption, or even arbitrary code execution.
The impact of this vulnerability is not yet proven. However, if successfully exploited, it could lead to a crash or arbitrary code execution.
Yes, this vulnerability has been fixed in Linux Kernel version v5.15.25 by commit 5e42fca37ccc76f39f73732661bd47254cad5982.
To update the Linux Kernel, you can fetch the latest kernel source code from the official Linux Kernel repository and compile it for your system. Alternatively, you can wait for your Linux distribution to provide an updated package.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
