CVE-2023-5178

What it actually does

Use-after-free and double-free in nvmet_tcp_free_crypto within the NVMe/TCP target subsystem caused by improper handling of crypto resources during connection teardown.

Why it matters to the business

Systems exposing NVMe over TCP targets face risk of remote code execution or local privilege escalation, potentially disrupting storage services and allowing unauthorized access to data or host resources until kernels are updated.

How an attack unfolds

An attacker with network access to an NVMe/TCP target triggers the flawed crypto free path by manipulating connection lifecycle events, leading to memory corruption that can be leveraged for code execution or privilege gain.

How to fix it

Upgrade the Linux kernel to include commit 87e8e7a7aa1f96276252a90373de1d56add31918 or apply the equivalent backported fix for the affected distribution.

How to confirm the fix worked

Verify the presence of commit 87e8e7a7aa1f96276252a90373de1d56add31918 in the kernel source or confirm the running kernel version contains the corrected nvmet_tcp_free_crypto logic; test NVMe/TCP target functionality post-upgrade.

Typical attack path

1. Locate systems running vulnerable Linux kernels with NVMe/TCP target enabled
2. Establish a TCP connection to the NVMe target
3. Send crafted NVMe commands or connection teardown sequences to exercise nvmet_tcp_free_crypto
4. Trigger the use-after-free condition through timing or state manipulation
5. Exploit resulting memory corruption for remote code execution or local privilege escalation

How to detect it

Inspect kernel logs and crash dumps for repeated nvmet_tcp_free_crypto references or use-after-free warnings; correlate with NVMe/TCP connection events from audit or system logs.

• nvmet_tcp_free_crypto
• use-after-free in drivers/nvme/target/tcp.c

What your security team should do

• Apply the referenced kernel commit or distribution patch immediately on all systems exposing NVMe/TCP targets
• Disable NVMe/TCP target functionality where not required until patched
• Monitor upstream kernel changelogs and distribution advisories for related fixes
• Review network exposure of storage targets and restrict access to trusted initiators