CVE-2023-5178: Kernel: use after free in nvmet_tcp_free_crypto in nvme
A use-after-free vulnerability was found in drivers/nvme/target/tcp.c in nvmettcpfreecrypto due to a logical bug in the NVMe-oF/TCP subsystem in the Linux kernel. In this flaw, a malicious user can cause a UAF and a double free, which may lead to RCE (may also lead to an LPE in case the attacker already has local privileges).
Reference: https://lore.kernel.org/linux-nvme/20231002105428.226515-1-sagi@grimberg.me/
Other sources
A use-after-free vulnerability was found in drivers/nvme/target/tcp.c in nvmettcpfreecrypto due to a logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation.
— Launchpad
Linux Kernel could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free flaw in the nvmettcpfreecrypto function in the NVMe-oF/TCP subsystem. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-5178?
CVE-2023-5178 is a use-after-free vulnerability in the Linux NVMe-oF/TCP Driver.
What is the severity of CVE-2023-5178?
The severity of CVE-2023-5178 is high with a CVSS score of 8.8.
How does CVE-2023-5178 impact the Linux kernel?
CVE-2023-5178 may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution.
What is the affected software for CVE-2023-5178?
The affected software includes Linux kernel versions up to 6.6, Linux kernel version 6.6-rc1 to 6.6-rc6, Redhat Kernel version 6.6, Redhat Enterprise Linux version 8.0, and Redhat Enterprise Linux version 9.0.
How can I fix CVE-2023-5178?
To fix CVE-2023-5178, update to Linux kernel version 6.6 or later, or update to a patched version of Redhat Kernel or Redhat Enterprise Linux.