In the Linux kernel, the following vulnerability has been resolved:
nvme: skip the zoned limits update if the zone info query failed
nvme_query_zone_info() returns either a negative errno or a positive
NVMe status code, but nvme_update_ns_info_block() only tests for the
negative case:
<pre>
ret = nvme_query_zone_info(ns, lbaf, &zi);
if (ret < 0)
goto out;
</pre>
If the device fails the Identify Namespace (I/O Command Set specific)
command, or the Identify Controller command issued by
nvme_set_max_append(), the positive status falls through and setup
continues with the zero-initialized zone info. nvme_update_zone_info()
then marks the queue zoned with chunk_sectors and ns->head->zsze set to
zero.
blk_validate_zoned_limits() does not check chunk_sectors, so the limits
commit succeeds. blk_revalidate_disk_zones() does reject the zero zone
size, but by then the limits are live and nothing rolls them back, so
I/O keeps being submitted to a zoned queue with a zero zone size and
disk_zone_no() shifts by ilog2(0):
nvme0n1: Invalid non power of two zone size (0)
UBSAN: shift-out-of-bounds in include/linux/blkdev.h:747:16
shift exponent -1 is negative
disk_zone_no include/linux/blkdev.h:747 [inline]
bio_straddles_zones include/linux/blkdev.h:1058 [inline]
blk_zone_wplug_handle_write block/blk-zoned.c:1423 [inline]
blk_zone_plug_bio.cold+0x25/0x1c8 block/blk-zoned.c:1605
blk_mq_submit_bio+0x18fb/0x2870 block/blk-mq.c:3196
submit_bh_wbc+0x575/0x740 fs/buffer.c:2824
__block_write_full_folio+0x728/0xdd0 fs/buffer.c:1933
Any device, firmware or NVMe-oF target that fails this one command
reaches this.
Skip the zoned limits update in that case, and log which of the two
things happened: during a revalidation the queue keeps the zone
geometry it was last validated with, and on a first scan the namespace
is registered without zoned limits, so that it is still available as a
handle for admin commands. Neither of the paths in
nvme_query_zone_info() that return a positive status logs anything, so
the failure would otherwise be silent.
zi.zone_size is an exact indicator: every path that returns a positive
status returns before it is assigned, and after that the only failure
left is -ENODEV, which the caller already handles.
Found by FuzzNvme.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 7.5
AV:N - The NVMe host core parses Identify responses during namespace scan for PCIe and NVMe-oF (nvme-tcp/rdma/fc). A malicious or compromised NVMe-oF target over routable TCP (typically 4420) can fail the ZNS Identify command and trigger the bug from the network.
AC:L - A malicious controller only needs to report CSI=ZNS then return a positive NVMe status on Identify CSI-NS or Identify CSI-CTRL; nvme_update_ns_info_block() treats that as success and installs zero zone geometry with no race or victim-specific layout.
PR:N - The attacker is the connected NVMe-oF peer and needs no host account or capability. NVMe/TCP TLS and DH-HMAC-CHAP are optional and off by default, matching prior NVMe-oF host CNA scoring as PR:N.
UI:N - Namespace scan and AEN Notice Namespace Changed rescans run in nvme_wq once a controller exists, including nvmf-autoconnect. Partition probe and filesystem writeback then submit I/O that hits disk_zone_no with no extra victim action at exploit time.
S:U - The invalid zoned limits and UBSAN shift occur in the host kernel block layer. This is not a VM escape, IOMMU bypass, or other cross-authority boundary.
C:N - The flaw leaves zi zero-initialized and later does sector >> ilog2(0) in disk_zone_no. That is an undefined shift, not an out-of-bounds read, use-after-free, or other kernel memory disclosure primitive.
I:N - nvme_update_zone_info() only programs this queue's chunk_sectors and zsze to zero from uncleared zi. There is no out-of-bounds write, use-after-free, or attacker-controlled write/control-flow hijack primitive.
A:H - FuzzNvme reproduced UBSAN shift-out-of-bounds in disk_zone_no on live I/O after zoned limits committed with zone size 0. CONFIG_UBSAN_TRAP and panic_on_warn panic the host, which kernel CNA guidance scores as high availability.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
None |
| Privileges Required |
None |
Integrity Impact |
None |
| User Interaction |
None |
Availability Impact |
High |
AV:N - The NVMe host core parses Identify responses during namespace scan for PCIe and NVMe-oF (nvme-tcp/rdma/fc). A malicious or compromised NVMe-oF target over routable TCP (typically 4420) can fail the ZNS Identify command and trigger the bug from the network.
AC:L - A malicious controller only needs to report CSI=ZNS then return a positive NVMe status on Identify CSI-NS or Identify CSI-CTRL; nvme_update_ns_info_block() treats that as success and installs zero zone geometry with no race or victim-specific layout.
PR:N - The attacker is the connected NVMe-oF peer and needs no host account or capability. NVMe/TCP TLS and DH-HMAC-CHAP are optional and off by default, matching prior NVMe-oF host CNA scoring as PR:N.
UI:N - Namespace scan and AEN Notice Namespace Changed rescans run in nvme_wq once a controller exists, including nvmf-autoconnect. Partition probe and filesystem writeback then submit I/O that hits disk_zone_no with no extra victim action at exploit time.
S:U - The invalid zoned limits and UBSAN shift occur in the host kernel block layer. This is not a VM escape, IOMMU bypass, or other cross-authority boundary.
C:N - The flaw leaves zi zero-initialized and later does sector >> ilog2(0) in disk_zone_no. That is an undefined shift, not an out-of-bounds read, use-after-free, or other kernel memory disclosure primitive.
I:N - nvme_update_zone_info() only programs this queue's chunk_sectors and zsze to zero from uncleared zi. There is no out-of-bounds write, use-after-free, or attacker-controlled write/control-flow hijack primitive.
A:H - FuzzNvme reproduced UBSAN shift-out-of-bounds in disk_zone_no on live I/O after zoned limits committed with zone size 0. CONFIG_UBSAN_TRAP and panic_on_warn panic the host, which kernel CNA guidance scores as high availability.
CVSS 3.1