CVE-2023-0122

What it actually does

A NULL pointer dereference in nvmet_setup_auth() allows remote unauthenticated attackers to crash the kernel by sending specially crafted NVMe authentication requests.

Why it matters to the business

Disrupts availability of systems using NVMe targets, potentially affecting storage services and requiring restarts, with higher impact in environments relying on Linux kernel versions 6.0-rc1 to rc3.

How an attack unfolds

An attacker connects to an exposed NVMe target and sends a pre-authentication request that triggers nvmet_setup_auth with a NULL pointer, causing a kernel crash.

How to fix it

Update the Linux kernel to version v6.0-rc4 or later, or apply the fix from commit da0342a3aa0357795224e6283df86444e1117168 in the NVMe target code.

How to confirm the fix worked

Verify the kernel version is at least v6.0-rc4 and confirm the presence of the fix commit in the source code.

Typical attack path

1. Scan for exposed NVMe over Fabrics endpoints
2. Establish connection to the target
3. Send crafted authentication setup command
4. Trigger NULL dereference leading to DoS

How to detect it

Examine kernel logs for NULL pointer dereference panics mentioning nvmet_setup_auth, and review network logs for connections to NVMe ports around the time of crashes.

• nvmet_setup_auth
• NULL pointer dereference
• kernel panic nvmet

What your security team should do

• Apply the kernel patch or upgrade immediately
• Monitor for unusual NVMe connection attempts
• Restrict access to NVMe target ports if possible