CVE-2024-50215

A flaw was found in the nvmet-auth component of the Linux kernel. An authenticated local attacker with administrative privileges could trigger a double free vulnerability by repeatedly calling nvmet_setup_dhgroup(). This could lead to a denial of service (DoS) or potentially arbitrary code execution.

This issue is considered to be a moderate impact flaw, as the exploitation for this will need an ADMIN (or ROOT) privilege (PR:H).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the nvmet_auth kernel module from loading if NVMe over Fabrics authentication is not required. Create /etc/modprobe.d/disable-nvmet-auth.conf with the following content:

install nvmet_auth /bin/true

After creating the file, regenerate the initramfs and reboot the system for the changes to take effect:

dracut -f -v reboot

Disabling this module may impact systems utilizing NVMe over Fabrics authentication.