nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.157, 6.12.110, 6.18.52, 7.2.6
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() Unlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls nvme_cmd_allowed(). Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor. Pass flags and open_for_write through and reject disallowed commands with -EACCES.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From a53295b6998f62d961c29e54051c1cf1d738c2b3 · fixed in c35cd98eed1a863e8dd51073953563cd8c907f68; From a53295b6998f62d961c29e54051c1cf1d738c2b3 · fixed in 95b0591d51dbf9e618d7845883d535e88ad7c8af; From a53295b6998f62d961c29e54051c1cf1d738c2b3 · fixed in 736b7c6adc7a65c4411beff197b6a634f7a6ca27; From a53295b6998f62d961c29e54051c1cf1d738c2b3 · fixed in b116e9dae433ff631f94c36c61a7a78fe400ed1e; From a53295b6998f62d961c29e54051c1cf1d738c2b3 · fixed in b53d495c7f0db46b6748b5ade48371a10dd5d3bc
- Linux Linux
3.3
- KernelLinux
From 3.3.0 · fixed in 6.6.157; From 6.7.0 · fixed in 6.12.110; From 6.13.0 · fixed in 6.18.52; From 6.19.0 · fixed in 7.2.6