CVE-2022-49003

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvme: fix SRCU protection of nvme_ns_head list

Walking the nvme_ns_head siblings list is protected by the head's srcu

in nvme_ns_head_submit_bio() but not nvme_mpath_revalidate_paths().

Removing namespaces from the list also fails to synchronize the srcu.

Concurrent scan work can therefore cause use-after-frees.

Hold the head's srcu lock in nvme_mpath_revalidate_paths() and

synchronize with the srcu, not the global RCU, in nvme_ns_remove().

Observed the following panic when making NVMe/RDMA connections

with native multipath on the Rocky Linux 8.6 kernel

(it seems the upstream kernel has the same race condition).

Disassembly shows the faulting instruction is cmp 0x50(%rdx),%rcx;

computing capacity != get_capacity(ns->disk).

Address 0x50 is dereferenced because ns->disk is NULL.

The NULL disk appears to be the result of concurrent scan work

freeing the namespace (note the log line in the middle of the panic).

[37314

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References