nvmet: fix return status of RMI log page on allocation failure
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.18.57, 7.2.6
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix return status of RMI log page on allocation failure nvmet_execute_get_log_page_rmi() leaves 'status' holding NVME_SC_SUCCESS (set by the successful nvmet_req_find_ns() call) when the kzalloc() for the log buffer fails. It then jumps to the out label and completes the request with a success status, so the host is told the command succeeded while no data was transferred. Initialize 'status' to NVME_SC_INTERNAL, matching the smart log handler, so an allocation failure is reported as an internal error.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 5fd075cdaf3649000677d960fd9e45c08081b7e0 · fixed in ffd56ada81f975a33f1df447f1bec9090a818e98; From 5fd075cdaf3649000677d960fd9e45c08081b7e0 · fixed in 9e136150ac55df4b7ea36e6110ffa39d08905f37; From 5fd075cdaf3649000677d960fd9e45c08081b7e0 · fixed in 581d8bb556dd3e5567bcf322aa5e3e4b6a200c08
- Linux Linux
6.13
- KernelLinux
From 6.13.0 · fixed in 6.18.57; From 6.19.0 · fixed in 7.2.6