In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nvme-fabrics: fix DHCHAP secret leak on parse failure<\/p>\n
nvmf_parse_options() duplicates dhchap_secret and dhchap_ctrl_secret
\nwith match_strdup() before validating the DHHC-1: representation.<\/p>\n
If validation fails, the parser returns -EINVAL before the temporary
\nstring in p is assigned to opts->dhchap_secret or
\nopts->dhchap_ctrl_secret. nvmf_create_ctrl() subsequently frees opts,
\nbut nvmf_free_options() cannot release the unassigned temporary string.
\nEach rejected option therefore leaks one allocation.<\/p>\n
This is easy to miss because valid secrets transfer ownership to opts
\nand are freed normally, while the malformed-secret path still returns
\nthe expected -EINVAL to userspace.<\/p>\n
With CONFIG_NVME_HOST_AUTH enabled, the leak is reachable before the
\nrequired-option checks and transport lookup. No NVMe-oF target or
\nworking transport connection is required; for example, repeatedly
\nwriting<\/p>\n
\tdhchap_secret=BAD<\/p>\n
or<\/p>\n
\tdhchap_ctrl_secret=BAD<\/p>\n
to \/dev\/nvme-fabrics deterministically takes the leaking parse path.<\/p>\n
Free the temporary string before leaving both validation error paths.
\nUse kfree_sensitive() because the copied option may contain secret
\nmaterial even when its representation is rejected, matching the
\nsensitive cleanup used for stored DHCHAP secrets.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nvme-fabrics: fix DHCHAP secret leak on parse failure<\/p>\n
nvmf_parse_options() duplicates dhchap_secret and dhchap_ctrl_secret
\nwith ma<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24662","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24662","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24662"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24662"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24662"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}