In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nvmet-auth: reject short AUTH_RECEIVE buffers<\/p>\n
nvmet_execute_auth_receive() trusts the AUTH_RECEIVE allocation length
\nafter checking only that it is nonzero and matches the transfer length.
\nIn the SUCCESS1 and FAILURE1\/default states, that lets a remote NVMe-oF
\ninitiator reach the fixed-size DH-HMAC-CHAP response builders with a
\nkmalloc() buffer shorter than the response, so nvmet_auth_success1() and
\nnvmet_auth_failure1() write past the allocation; both only WARN_ON the
\nshort length and then format the message anyway.<\/p>\n
Impact: A remote NVMe-oF initiator with access to an auth-enabled target
\ncan trigger a 16-byte heap out-of-bounds write via a one-byte
\nAUTH_RECEIVE allocation length.<\/p>\n
Compute the minimum response length for the current DH-HMAC-CHAP step in
\nnvmet_auth_receive_data_len() and report a zero data length when the
\nhost-supplied allocation length is shorter, so the existing zero-length
\ncheck in nvmet_execute_auth_receive() rejects the command before any
\nbuilder runs. The SUCCESS1 minimum is sizeof(struct
\nnvmf_auth_dhchap_success1_data) plus the HMAC hash length, because the
\nresponse hash is written into the rval[] flexible-array tail, so the
\nminimum is state dependent rather than a flat sizeof. CHALLENGE keeps its
\nexisting variable-length guard in nvmet_auth_challenge().<\/p>\n
This is reachable only when in-band DH-HMAC-CHAP authentication is
\nconfigured on the target.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nvmet-auth: reject short AUTH_RECEIVE buffers<\/p>\n
nvmet_execute_auth_receive() trusts the AUTH_RECEIVE allocation length
\nafter checkin<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6794","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6794","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6794"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6794"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6794"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}