CVE-2024-50215

What it actually does

Double-free vulnerability in nvmet-auth where ctrl->dh_key is not set to NULL after kfree_sensitive on error paths in nvmet_setup_dhgroup, allowing reuse and double free in nvmet_destroy_auth.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel crashes or arbitrary code execution, risking system compromise and downtime in environments using NVMe targets.

How an attack unfolds

An attacker with local access triggers repeated nvmet_setup_dhgroup calls that hit error paths for the same controller, causing the dh_key pointer to be freed multiple times without nullification, leading to memory corruption exploitable for privilege escalation.

How to fix it

Update the Linux kernel to the fixed commit c94e965f766321641ec38e4eece9ce8884543244 or apply the equivalent stable patch that nullifies dh_key after kfree_sensitive.

How to confirm the fix worked

Verify the presence of the null assignment to dh_key after kfree_sensitive in nvmet_setup_dhgroup and confirm the kernel build includes commit c94e965f766321641ec38e4eece9ce8884543244.

Typical attack path

1. Obtain local access to a system running vulnerable Linux kernel with NVMe target enabled
2. Trigger multiple nvmet_setup_dhgroup invocations hitting error paths for the same controller
3. Force nvmet_destroy_auth to process the already-freed dh_key pointer
4. Exploit resulting double-free for memory corruption and code execution

How to detect it

Review kernel logs for double-free warnings or oops related to nvmet-auth and nvmet_destroy_auth; inspect audit logs for unusual nvmet_setup_dhgroup activity.

What your security team should do

• Prioritize kernel upgrade to the fixed version across all affected systems
• Monitor for local privilege escalation attempts in high-risk environments
• Restrict untrusted local access until patches are deployed