{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-42152", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-29T15:50:41.193Z", "datePublished": "2024-07-30T07:46:44.795Z", "dateUpdated": "2026-08-05T11:35:52.904Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:35:52.904Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix a possible leak when destroy a ctrl during qp establishment\n\nIn nvmet_sq_destroy we capture sq->ctrl early and if it is non-NULL we\nknow that a ctrl was allocated (in the admin connect request handler)\nand we need to release pending AERs, clear ctrl->sqs and sq->ctrl\n(for nvme-loop primarily), and drop the final reference on the ctrl.\n\nHowever, a small window is possible where nvmet_sq_destroy starts (as\na result of the client giving up and disconnecting) concurrently with\nthe nvme admin connect cmd (which may be in an early stage). But *before*\nkill_and_confirm of sq->ref (i.e. the admin connect managed to get an sq\nlive reference). In this case, sq->ctrl was allocated however after it was\ncaptured in a local variable in nvmet_sq_destroy.\nThis prevented the final reference drop on the ctrl.\n\nSolve this by re-capturing the sq->ctrl after all inflight request has\ncompleted, where for sure sq->ctrl reference is final, and move forward\nbased on that.\n\nThis issue was observed in an environment with many hosts connecting\nmultiple ctrls simoutanuosly, creating a delay in allocating a ctrl\nleading up to this race window." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - The race is in the generic NVMe-oF target core (`nvmet_sq_destroy`) and is driven by a remote initiator's admin Connect capsule racing its own transport disconnect; in nvmet-rdma `nvmet_rdma_free_queue()` calls `nvmet_sq_destroy()` before `nvmet_rdma_destroy_queue_ib()`/`ib_drain_qp()`, so `nvmet_rdma_recv_done()` → `nvmet_execute_admin_connect()` runs concurrently on a still-live QP. The vulnerable component is a network-bound storage target (NVMe-oF over RDMA/RoCEv2/iWARP/FC), reachable purely over the fabric with no local access.\nAC:L - The attacker controls both sides of the race — it sends the admin Connect capsule and then immediately tears down the connection (rdma_disconnect/CM DREQ), and can retry in a tight loop from many parallel connections. The commit itself notes the window widens when many hosts connect simultaneously (delaying `nvmet_alloc_ctrl()`), a condition an attacker deliberately reproduces by flooding the target with concurrent connects.\nPR:N - The Connect command is the pre-authentication handshake itself, and `nvmet_host_allowed()` returns true unconditionally for the discovery subsystem (\"allow all access to disc subsys\"), while NVM subsystems are commonly deployed with `attr_allow_any_host=1`; DH-CHAP is optional and off by default. An unauthenticated remote peer can therefore reach `nvmet_alloc_ctrl()` and allocate a controller with no credentials.\nUI:N - The attacker's own initiator performs both the Connect and the disconnect; no victim action, mount, or administrator interaction is required.\nS:U - The leaked `nvmet_ctrl` and the resulting resource exhaustion are confined to the kernel of the target host; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - `ctrl->sqs[]` entries are only compared and assigned, never dereferenced, so the stale pointers left behind produce no read of freed memory, and nothing from the leaked controller is returned to the attacker.\nI:N - No memory is corrupted and no data is modified — the missing `nvmet_ctrl_put()` only skips a reference drop and leaves `sq->ctrl`/`ctrl->sqs[qid]` uncleared, yielding no write primitive.\nA:H - Every won race permanently leaks a `nvmet_ctrl` (controller struct, 4 KB `changed_ns_list`, `sqs` array, subsystem reference, and a `cntlid_ida` entry), and the zombie controller stays on `subsys->ctrls` accumulating `nvmet_async_event` allocations forever, so an unauthenticated peer can repeat it without limit to exhaust kernel memory. Exhausting the 65519-entry cntlid range additionally makes `nvmet_alloc_ctrl()` fail with CONNECT_CTRL_BUSY, denying all new connections and blocking subsystem teardown — a persistent, complete denial of the storage service until reboot." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/nvme/target/core.c" ], "versions": [ { "version": "0f5be6a4ff7b3f8bf3db15f904e3e76797a43d9a", "lessThan": "2f3c22b1d3d7e86712253244797a651998c141fa", "status": "affected", "versionType": "git" }, { "version": "0f5be6a4ff7b3f8bf3db15f904e3e76797a43d9a", "lessThan": "b4fed1443a6571d49c6ffe7d97af3bbe5ee6dff5", "status": "affected", "versionType": "git" }, { "version": "0f5be6a4ff7b3f8bf3db15f904e3e76797a43d9a", "lessThan": "940a71f08ef153ef807f751310b0648d1fa5d0da", "status": "affected", "versionType": "git" }, { "version": "0f5be6a4ff7b3f8bf3db15f904e3e76797a43d9a", "lessThan": "5502c1f1d0d7472706cc1f201aecf1c935d302d1", "status": "affected", "versionType": "git" }, { "version": "0f5be6a4ff7b3f8bf3db15f904e3e76797a43d9a", "lessThan": "818004f2a380420c19872171be716174d4985e33", "status": "affected", "versionType": "git" }, { "version": "0f5be6a4ff7b3f8bf3db15f904e3e76797a43d9a", "lessThan": "c758b77d4a0a0ed3a1292b3fd7a2aeccd1a169a4", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/nvme/target/core.c" ], "versions": [ { "version": "5.6", "status": "affected" }, { "version": "0", "lessThan": "5.6", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.222", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.163", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.98", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.39", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9.9", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "5.10.222" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "5.15.163" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.1.98" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.6.39" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.9.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.10" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/2f3c22b1d3d7e86712253244797a651998c141fa" }, { "url": "https://git.kernel.org/stable/c/b4fed1443a6571d49c6ffe7d97af3bbe5ee6dff5" }, { "url": "https://git.kernel.org/stable/c/940a71f08ef153ef807f751310b0648d1fa5d0da" }, { "url": "https://git.kernel.org/stable/c/5502c1f1d0d7472706cc1f201aecf1c935d302d1" }, { "url": "https://git.kernel.org/stable/c/818004f2a380420c19872171be716174d4985e33" }, { "url": "https://git.kernel.org/stable/c/c758b77d4a0a0ed3a1292b3fd7a2aeccd1a169a4" } ], "title": "nvmet: fix a possible leak when destroy a ctrl during qp establishment", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/2f3c22b1d3d7e86712253244797a651998c141fa", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/b4fed1443a6571d49c6ffe7d97af3bbe5ee6dff5", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/940a71f08ef153ef807f751310b0648d1fa5d0da", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/5502c1f1d0d7472706cc1f201aecf1c935d302d1", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/818004f2a380420c19872171be716174d4985e33", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/c758b77d4a0a0ed3a1292b3fd7a2aeccd1a169a4", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:02:15.586Z" } }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-42152", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T16:15:21.603444Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:34.451Z" } } ] } }