CVE-2023-52454

What it actually does

Invalid H2CData PDU length from an NVMe host triggers NULL pointer dereference in nvmet_tcp_build_pdu_iovec, crashing the kernel worker thread.

Why it matters to the business

Systems running the NVMe over TCP target can experience sudden kernel panics and reboots when a connected host sends a malformed command, leading to unplanned downtime and potential data loss in storage environments.

How an attack unfolds

An attacker acting as an NVMe host establishes a TCP connection to the target, sends an H2CData command PDU whose DATAL field is inconsistent with the actual packet size or exceeds the negotiated MAXH2CDATA value, and causes the kernel to dereference a null pointer during iovec construction in the TCP I/O work handler.

How to fix it

Update the Linux kernel to a version containing commit ee5e7632e981673f42a50ade25e71e612e543d9d which adds a length coherence check and raises a fatal error for invalid DATAL values.

How to confirm the fix worked

Confirm the fix is present by inspecting the nvmet_tcp.c source for the added DATAL validation logic before nvmet_tcp_build_pdu_iovec, or verify the running kernel contains the referenced commit hash.

Typical attack path

1. Establish TCP connection to nvmet target and complete ICReq negotiation
2. Transmit H2CData PDU containing an invalid or oversized DATAL field
3. Trigger nvmet_tcp_io_work path that calls nvmet_tcp_build_pdu_iovec on the malformed PDU
4. Cause NULL pointer dereference and kernel panic

How to detect it

Search kernel logs for oops or panic messages containing nvmet_tcp_io_work and nvmet_tcp_build_pdu_iovec, and review audit logs for unexpected NVMe/TCP connections from untrusted hosts.

What your security team should do

• Prioritize patching all systems exposing nvmet-tcp targets to the fixed commit
• Monitor for kernel oops involving nvmet_tcp_io_work and nvmet_tcp_build_pdu_iovec
• Restrict NVMe/TCP target exposure to trusted initiators only until patched