Junglewise Threat Intelligence

CVE-2023-6121: Linux Kernel out-of-bounds read in NVMe-oF/TCP subsystem

CVE-2023-6121 · Severity: medium · CVSS 4.3 · Published 2023-11-16

Technologies: Linux Kernel. Vendors: Linux, Red Hat.

Executive brief

A vulnerability exists in the Linux kernel's NVMe-over-Fabrics (NVMe-oF) TCP subsystem, which is used to connect storage devices over a network. An attacker can send a specially crafted network packet to a system using this feature to read sensitive information from the computer's memory. This could lead to the exposure of internal system data, potentially aiding in further attacks or compromising system privacy.

Technical details

An out-of-bounds read vulnerability (CWE-125) was identified in the NVMe-oF/TCP subsystem of the Linux kernel, specifically within the nvmet_ctrl_find_get function. A remote attacker with low privileges can send a crafted TCP packet that triggers a heap-based buffer overflow. This results in an out-of-bounds read where sensitive kmalloc data is printed to the kernel ring buffer (dmesg), potentially allowing for information disclosure of kernel memory. The vulnerability has been addressed in various Linux distributions, including Red Hat Enterprise Linux 8 and 9 via kernel updates.

Affected products

  • Linux Linux Kernel NVMe-oF/TCP subsystem
  • Red Hat Enterprise Linux 8.10
  • Red Hat Enterprise Linux 9.4

Timeline

  • 2023-11-16: disclosed: Initial disclosure by Red Hat
  • 2023-11-16: advisory: CVE-2023-6121 published to NVD
  • 2024-04-30: patched: Red Hat released security update RHSA-2024:2394 for RHEL 9
  • 2024-05-22: patched: Red Hat released security update RHSA-2024:2950 for RHEL 8

References

Related threats