Description
In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid potential UAF in nvmet_req_complete() An nvme target ->queue_response() operation implementation may free the request passed as argument. Such implementation potentially could result in a use after free of the request pointer when percpu_ref_put() is called in nvmet_req_complete(). Avoid such problem by using a local variable to save the sq pointer before calling __nvmet_req_complete(), thus avoiding dereferencing the req pointer after that function call.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
a07b4970f464f13640e28e16dad6cfa33647cc99 to < e5d99b29012bbf0e86929403209723b2806500c1affecteda07b4970f464f13640e28e16dad6cfa33647cc99 to < fafcb4b26393870c45462f9af6a48e581dbbcf7eaffecteda07b4970f464f13640e28e16dad6cfa33647cc99 to < 04c394208831d5e0d5cfee46722eb0f033cd4083affecteda07b4970f464f13640e28e16dad6cfa33647cc99 to < a6317235da8aa7cb97529ebc8121cc2a4c4c437aaffecteda07b4970f464f13640e28e16dad6cfa33647cc99 to < f1d5888a5efe345b63c430b256e95acb0a475642affecteda07b4970f464f13640e28e16dad6cfa33647cc99 to < bcd535f07c58342302a2cd2bdd8894fe0872c8a9affecteda07b4970f464f13640e28e16dad6cfa33647cc99 to < 8ed9813871038b25a934b21ab76b5b7dbf44fc3aaffecteda07b4970f464f13640e28e16dad6cfa33647cc99 to < 6173a77b7e9d3e202bdb9897b23f2a8afe7bf286affected
Linux Linux
Default version status: affected
4.8affected0 to < 4.8unaffected4.14.311 to ≤ 4.14.*unaffected4.19.279 to ≤ 4.19.*unaffected5.4.238 to ≤ 5.4.*unaffected5.10.176 to ≤ 5.10.*unaffected5.15.104 to ≤ 5.15.*unaffected6.1.21 to ≤ 6.1.*unaffected6.2.8 to ≤ 6.2.*unaffected6.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/e5d99b29012bbf0e86929403209723b2806500c1 ↗
- https://git.kernel.org/stable/c/fafcb4b26393870c45462f9af6a48e581dbbcf7e ↗
- https://git.kernel.org/stable/c/04c394208831d5e0d5cfee46722eb0f033cd4083 ↗
- https://git.kernel.org/stable/c/a6317235da8aa7cb97529ebc8121cc2a4c4c437a ↗
- https://git.kernel.org/stable/c/f1d5888a5efe345b63c430b256e95acb0a475642 ↗
- https://git.kernel.org/stable/c/bcd535f07c58342302a2cd2bdd8894fe0872c8a9 ↗
- https://git.kernel.org/stable/c/8ed9813871038b25a934b21ab76b5b7dbf44fc3a ↗
- https://git.kernel.org/stable/c/6173a77b7e9d3e202bdb9897b23f2a8afe7bf286 ↗