CVE-2023-53643

A race condition leading to NULL pointer dereference was found in the Linux kernel NVMe-over-TCP driver's error recovery handling. A local user with privileges to execute NVMe management commands can run the 'nvme list' command while NVMe-over-TCP error recovery work is temporarily failing reconnect attempts and cycling sockets, causing the driver to call getsockname() on a released socket pointer, which results in a NULL pointer dereference and denial of service through kernel crash.

The issue arises because of insufficient synchronization between error recovery operations and socket information queries. When an NVMe-over-TCP connection experiences errors, the error recovery work releases the existing socket and creates a new one to establish a fresh connection. During this transition, there is a window where the socket pointer may be NULL or point to freed memory. If userspace executes the 'nvme list' command during this window, the kernel attempts to gather connection information by calling getsockname() on the socket. Without proper validation, this results in dereferencing a NULL or invalid pointer, causing an immediate kernel crash. The race window is narrow, requiring error recovery to be actively cycling sockets when the list command executes. While this reliably causes crashes when the race is won, NULL pointer dereferences on modern kernels with SMAP/SMEP protections cannot be exploited for code execution or information disclosure, only denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the nvme_tcp module from loading. See https://access.redhat.com/solutions/41278 for instructions on blacklisting kernel modules.