Description
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() nvme_tcp_recv_pdu() doesn't check the validity of the header length. When header digests are enabled, a target might send a packet with an invalid header length (e.g. 255), causing nvme_tcp_verify_hdgst() to access memory outside the allocated area and cause memory corruptions by overwriting it with the calculated digest. Fix this by rejecting packets with an unexpected header length.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
3f2304f8c6d6ed97849057bd16fee99e434ca796 to < 3b54109b2f771f74fd53b027429796326f84ab36affected3f2304f8c6d6ed97849057bd16fee99e434ca796 to < 9d22cf5cc94cd7dee84773ec41db78a46107dfa3affected3f2304f8c6d6ed97849057bd16fee99e434ca796 to < 9fbc953d6b38bc824392e01850f0aeee3b348722affected3f2304f8c6d6ed97849057bd16fee99e434ca796 to < 22b06c89aa6b2d1ecb8aea72edfb9d53af8d5126affected3f2304f8c6d6ed97849057bd16fee99e434ca796 to < ad95bab0cd28ed77c2c0d0b6e76e03e031391064affected
Linux Linux
Default version status: affected
5.0affected0 to < 5.0unaffected6.1.191 to ≤ 6.1.*unaffected6.6.160 to ≤ 6.6.*unaffected6.12.19 to ≤ 6.12.*unaffected6.13.7 to ≤ 6.13.*unaffected6.14 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/3b54109b2f771f74fd53b027429796326f84ab36 ↗
- https://git.kernel.org/stable/c/9d22cf5cc94cd7dee84773ec41db78a46107dfa3 ↗
- https://git.kernel.org/stable/c/9fbc953d6b38bc824392e01850f0aeee3b348722 ↗
- https://git.kernel.org/stable/c/22b06c89aa6b2d1ecb8aea72edfb9d53af8d5126 ↗
- https://git.kernel.org/stable/c/ad95bab0cd28ed77c2c0d0b6e76e03e031391064 ↗