CVE-2024-53681

What it actually does

In the NVMe target subsystem, nvmet_root_discovery_nqn_store treats a dynamically allocated subsysnqn string as a fixed-size buffer, allowing an oversized value to overflow into adjacent memory instead of safely duplicating it via kstrndup.

Why it matters to the business

Memory corruption in kernel space on systems exposing nvmet discovery interfaces can lead to crashes, denial of service, or potential local privilege escalation; low exploitability and no known campaigns reduce immediate operational risk, but unpatched kernels remain exposed until upgrades are applied.

How an attack unfolds

An attacker with write access to the nvmet discovery NQN sysfs attribute supplies a string longer than the originally allocated buffer; the store function copies without length enforcement, overflowing the buffer and corrupting kernel memory structures.

How to fix it

Upgrade the Linux kernel to include commit 86645d8d062af3fdcbdaa0a289b95de55bca827d. On Ubuntu Pro 14.04/16.04/18.04 LTS systems, install the corresponding shadow package versions 1:4.1.5.1-1ubuntu9.5+esm1, 1:4.2-3.1ubuntu5.5+esm1, or 1:4.5-1ubuntu1. Restrict sysfs write access to nvmet configuration until patches are deployed.

How to confirm the fix worked

Confirm the running kernel contains commit 86645d8d062af3fdcbdaa0a289b95de55bca827d or verify installed package versions match the listed fixed releases; attempt to store a subsysnqn longer than the prior allocation size and observe that the operation now succeeds without overflow.

Typical attack path

1. Locate systems with nvmet configured and the vulnerable discovery NQN store path exposed
2. Obtain local write access to the /sys/kernel/config/nvmet/.../discovery NQN attribute
3. Write an oversized subsysnqn value to trigger the overflow
4. Leverage resulting memory corruption for denial of service or escalation

How to detect it

Review kernel logs for nvmet-related oops or panic messages; inspect sysfs audit logs for unusually long writes to discovery NQN attributes; correlate with process activity writing to nvmet config paths.

What your security team should do

• Apply kernel and shadow package updates immediately on any system using nvmet
• Audit nvmet configurations and limit write access to discovery NQN attributes
• Monitor EPSS and KEV status for changes given the 635 days since publication