In the Linux kernel, the following vulnerability has been resolved:
nvmet-auth: reject short AUTH_RECEIVE buffers
nvmet_execute_auth_receive() trusts the AUTH_RECEIVE allocation length
after checking only that it is nonzero and matches the transfer length.
In the SUCCESS1 and FAILURE1/default states, that lets a remote NVMe-oF
initiator reach the fixed-size DH-HMAC-CHAP response builders with a
kmalloc() buffer shorter than the response, so nvmet_auth_success1() and
nvmet_auth_failure1() write past the allocation; both only WARN_ON the
short length and then format the message anyway.
Impact: A remote NVMe-oF initiator with access to an auth-enabled target
can trigger a 16-byte heap out-of-bounds write via a one-byte
AUTH_RECEIVE allocation length.
Compute the minimum response length for the current DH-HMAC-CHAP step in
nvmet_auth_receive_data_len() and report a zero data length when the
host-supplied allocation length is shorter, so the existing zero-length
check in nvmet_execute_auth_receive() rejects the command before any
builder runs. The SUCCESS1 minimum is sizeof(struct
nvmf_auth_dhchap_success1_data) plus the HMAC hash length, because the
response hash is written into the rval[] flexible-array tail, so the
minimum is state dependent rather than a flat sizeof. CHALLENGE keeps its
existing variable-length guard in nvmet_auth_challenge().
This is reachable only when in-band DH-HMAC-CHAP authentication is
configured on the target.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - The bug is in nvmet DH-HMAC-CHAP AUTH_RECEIVE handling reached by remote NVMe-oF initiators over network transports (nvmet-tcp/RDMA/FC); malicious allocation length arrives in a Fabrics command capsule from the network.
AC:L - Once an auth-enabled target is reachable, the attacker fully controls AUTH_RECEIVE allocation length and can reliably reach vulnerable states (e.g. default NEGOTIATE branch or FAILURE1) without conditions beyond their control.
PR:N - Exploitation occurs on the pre-authentication DH-HMAC-CHAP handshake before credentials are verified; no Linux privileges on the target are required, only network access to an auth-configured NVMe-oF target port.
UI:N - No victim user action is required beyond the administrator having already deployed an NVMe-oF target; exploitation is driven entirely by attacker-sent Fabrics authentication commands.
S:U - Impact is kernel heap memory corruption within the NVMe target subsystem on the same host; it does not cross a VM/hypervisor or IOMMU security boundary by itself.
C:H - A controlled heap out-of-bounds write (up to 16 bytes plus optional HMAC tail in SUCCESS1) can corrupt adjacent kmalloc objects and be leveraged for kernel information disclosure, per memory-corruption guidance.
I:H - The vulnerability is a heap out-of-bounds write in kernel context; such corruption is exploitable for arbitrary memory modification and potential code execution, not merely a bounded logic error.
A:H - Heap corruption can cause kernel oops/panic, and the FAILURE1 AUTH_RECEIVE completion path calls nvmet_ctrl_fatal_error(), taking down the NVMe controller and denying service to connected initiators.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - The bug is in nvmet DH-HMAC-CHAP AUTH_RECEIVE handling reached by remote NVMe-oF initiators over network transports (nvmet-tcp/RDMA/FC); malicious allocation length arrives in a Fabrics command capsule from the network.
AC:L - Once an auth-enabled target is reachable, the attacker fully controls AUTH_RECEIVE allocation length and can reliably reach vulnerable states (e.g. default NEGOTIATE branch or FAILURE1) without conditions beyond their control.
PR:N - Exploitation occurs on the pre-authentication DH-HMAC-CHAP handshake before credentials are verified; no Linux privileges on the target are required, only network access to an auth-configured NVMe-oF target port.
UI:N - No victim user action is required beyond the administrator having already deployed an NVMe-oF target; exploitation is driven entirely by attacker-sent Fabrics authentication commands.
S:U - Impact is kernel heap memory corruption within the NVMe target subsystem on the same host; it does not cross a VM/hypervisor or IOMMU security boundary by itself.
C:H - A controlled heap out-of-bounds write (up to 16 bytes plus optional HMAC tail in SUCCESS1) can corrupt adjacent kmalloc objects and be leveraged for kernel information disclosure, per memory-corruption guidance.
I:H - The vulnerability is a heap out-of-bounds write in kernel context; such corruption is exploitable for arbitrary memory modification and potential code execution, not merely a bounded logic error.
A:H - Heap corruption can cause kernel oops/panic, and the FAILURE1 AUTH_RECEIVE completion path calls nvmet_ctrl_fatal_error(), taking down the NVMe controller and denying service to connected initiators.
CVSS 3.1