Executive brief
The Linux kernel's NVMe TCP target driver processes NVMe commands from remote clients over TCP. A missing bounds check allowed malicious or malformed TCP connections to specify an arbitrary Transfer Tag (ttag) value, causing the kernel to access memory outside a valid command array. This could crash the system or allow local privilege escalation on systems accepting untrusted NVMe traffic.
Technical details
The vulnerability is an out-of-bounds access in the nvmet_tcp_handle_h2c_data_pdu() function in drivers/nvme/target/tcp.c. The Transfer Tag (ttag) field from incoming NVMe data PDUs was used directly as an array index without validating it against the queue's command count (nr_cmds). An attacker sending a specially crafted NVMe data frame with an out-of-bounds ttag value could trigger out-of-bounds memory access. The fix adds an explicit bounds check: if (unlikely(data->ttag >= queue->nr_cmds)) before using ttag as an array index. Attack vector requires network access to an NVMe target endpoint accepting TCP connections.
Affected products
- Linux Linux kernel before patch b6a545ffa2c192b1e6da4a7924edac5ba9f4ea2b
Timeline
- 2022-09-21: disclosed
- 2022-10-21: patched: patch applied to stable trees