Fix possible req->offset corruption in nvme-tcp
Summary
UVI-2021-1002067: nvme-tcp: fix possible req->offset corruption. Affects Kernel versions >= db5ad6b7f8cdd6d78efef62a1557461d0cbaee54, < c63d7f2ca99a2e2a9b62d42bffa0ccec407b91b0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The nvme-tcp package is a component of the Linux Kernel ecosystem. It provides support for NVMe over TCP, allowing for remote access to NVMe devices. NVMe (Non-Volatile Memory Express) is a protocol designed for efficient communication with solid-state drives (SSDs) over a PCI Express (PCIe) bus. The nvme-tcp module enables the use of NVMe devices over TCP/IP networks, providing a network-based storage solution. However, a vulnerability has been discovered in nvme-tcp that could lead to req->offset corruption.
Vulnerability Detail
The vulnerability in nvme-tcp involves possible req->offset corruption. This vulnerability could have security implications, although the actual impact and attack plausibility have not been proven. The vulnerability was introduced in version v5.8 of the Linux Kernel by commit db5ad6b7f8cdd6d78efef62a1557461d0cbaee54 and is fixed in version v5.10.77 by commit c63d7f2ca99a2e2a9b62d42bffa0ccec407b91b0. The req->offset corruption issue could potentially be exploited by attackers to manipulate or corrupt data during NVMe over TCP communication.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The vulnerability in nvme-tcp that could lead to req->offset corruption has been identified and fixed in the Linux Kernel version v5.10.77. It is recommended to update the kernel to the latest version to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
nvme-tcp is a component of the Linux Kernel that enables NVMe over TCP, allowing remote access to NVMe devices over TCP/IP networks.
Req->offset corruption refers to a potential issue in nvme-tcp where the offset value of a request could be manipulated or corrupted, leading to data integrity issues during NVMe over TCP communication.
The impact of this vulnerability is not yet proven, but it could potentially allow attackers to manipulate or corrupt data during NVMe over TCP communication.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.10.77 or later.
No specific workaround has been mentioned for this vulnerability. Updating the Linux Kernel to the fixed version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
