In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nvmet-tcp: bound SGL data length before allocating command buffers<\/p>\n
nvmet_tcp_map_data() reads the host-controlled 32-bit sgl->length
\nand, for the in-capsule offset descriptor (type 0x01), checks it
\nagainst port->inline_data_size before use. Any other SGL descriptor
\ntype — including the non-inline transport SGL data-block descriptor
\n(type (NVME_TRANSPORT_SGL_DATA_DESC <req.sg = sgl_alloc(len, GFP_KERNEL, &cmd->req.sg_cnt);<\/p>\n
with len taken directly from the wire, unbounded up to 4 GiB.<\/p>\n
nvmet_req_init() only parses the command and never inspects
\nsgl->length, and nvmet_check_transfer_len() — the only other place
\ntransfer_len is validated — runs later, from req->execute(), after
\nthe allocation has already happened. For a write command the target
\nresponds with an R2T and parks the command waiting for the host to
\nsend the data; if the host (or an unauthenticated peer that simply
\nnever follows up) never does, the sgl_alloc() buffer stays resident
\nfor the life of the command. NVMe\/TCP has no mandatory authentication
\nin the default configuration, so any peer able to reach the target
\nportal and complete a Fabrics connect can drive this with a single
\ncrafted command, repeatable across queues and connections for
\namplification. This is unbounded kernel memory allocation
\ntriggered by a remote, effectively unauthenticated peer.<\/p>\n
Validate len against the same NVMET_TCP_MAXH2CDATA ceiling this file
\nalready uses to bound per-PDU H2C data, for every SGL descriptor type,
\nbefore doing any allocation. This closes the gap for the non-inline
\ndescriptor while leaving the existing, tighter inline_data_size check
\nin place for the in-capsule case.<\/p>\n
Runtime-verified on a v6.19 KASAN stand: with this bound in place, a
\ncrafted write command carrying an oversized non-inline SGL length is
\nrejected before sgl_alloc() runs, where the same request previously
\ndrove an unbounded ~256 MiB kernel allocation (up to 4 GiB) that
\nstayed resident pending an R2T the host never satisfies.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nvmet-tcp: bound SGL data length before allocating command buffers<\/p>\n
nvmet_tcp_map_data() reads the host-controlled 32-bit sgl->leng<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17293","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17293","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17293"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17293"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17293"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}