CoreCVE
Back

HIGH

Kernel: use after free in nvmet_tcp_free_crypto in nvme

Published Nov 1, 2023

Description

A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation.

Affected products

Remediation

Vendor solution

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Red Hat statement

This vulnerability is actual only for systems where NVME over TCP being used.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Weaknesses (1)

CWE-416

Use After Free

References (29)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Nov 1, 2023
Updated Mar 24, 2026
Reserved Sep 25, 2023
Link CVE-2023-5178
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2023-5178
Red Hat
Severity Important
Public date Oct 15, 2023
Links CVE-2023-5178 - Bugzilla
ENISA EUVD
Assigner redhat
Published Nov 1, 2023
Updated Mar 24, 2026
Exploited since n/a
Link EUVD-2023-57515
EUVD-2023-57515