Описание
In the Linux kernel, the following vulnerability has been resolved:
nvme: fix racy access to FDP placement id array
nvme_query_fdp_info() is called per-path and therefore prone to races.
It populates head->nr_plids/head->plids for fdp registration.
But nothing protects that pair from concurrent access - two paths scanning
the same namespace can race to populate it.
Avoid the race by moving this initialization work to nvme_alloc_ns_head()
which is called once per shared namespace.
A flaw was found in the Linux kernel's NVMe driver. A race condition can lead to a denial of service (DoS) or memory corruption when multiple paths scan the same shared namespace concurrently. Because access to the Flexible Data Placement (FDP) configuration data is unprotected during initialization, concurrent operations can corrupt internal data structures, allowing a local user to destabilize or crash the system.
Отчет
A low-impact race condition flaw was found in the Linux kernel's NVMe driver, affecting the kernel in Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and the RHEL CoreOS 9 kernel shipped with OpenShift Container Platform 4.22 and later. When an NVMe namespace is shared across multiple paths, nvme_query_fdp_info() is called per path and populates the namespace head's Flexible Data Placement (FDP) placement ID array (head->nr_plids/head->plids) without synchronization. Two paths scanning the same shared namespace concurrently can race to populate this pair, leaving inconsistent FDP state or leaked allocations and potentially allowing a local user to destabilize or crash the system. The impact is rated low because exploiting the flaw requires a multipath NVMe configuration with FDP-capable hardware and winning a timing-dependent race during namespace discovery. Red Hat Enterprise Linux 6, 7, and 8, the earlier RHEL 9 and RHEL 10 update streams, and OpenShift Container Platform releases prior to 4.22 are not affected because the vulnerable FDP registration code is not present in those kernels. For the affected streams the fix is deferred given the low impact and constrained exploitability; the residual risk is limited to denial of service or corruption of internal kernel FDP data structures on multipath NVMe systems until a fix is delivered.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: nvme: fix racy access to FDP placement id array nvme_query_fdp_info() is called per-path and therefore prone to races. It populates head->nr_plids/head->plids for fdp registration. But nothing protects that pair from concurrent access - two paths scanning the same namespace can race to populate it. Avoid the race by moving this initialization work to nvme_alloc_ns_head() which is called once per shared namespace.
In the Linux kernel, the following vulnerability has been resolved: nvme: fix racy access to FDP placement id array nvme_query_fdp_info() is called per-path and therefore prone to races. It populates head->nr_plids/head->plids for fdp registration. But nothing protects that pair from concurrent access - two paths scanning the same namespace can race to populate it. Avoid the race by moving this initialization work to nvme_alloc_ns_head() which is called once per shared namespace.
In the Linux kernel, the following vulnerability has been resolved: n ...
In the Linux kernel, the following vulnerability has been resolved: nvme: fix racy access to FDP placement id array nvme_query_fdp_info() is called per-path and therefore prone to races. It populates head->nr_plids/head->plids for fdp registration. But nothing protects that pair from concurrent access - two paths scanning the same namespace can race to populate it. Avoid the race by moving this initialization work to nvme_alloc_ns_head() which is called once per shared namespace.
EPSS
5.5 Medium
CVSS3