CVE-2023-53643

Red Hat statement

The issue arises because of insufficient synchronization between error recovery operations and socket information queries. When an NVMe-over-TCP connection experiences errors, the error recovery work releases the existing socket and creates a new one to establish a fresh connection. During this transition, there is a window where the socket pointer may be NULL or point to freed memory. If userspace executes the 'nvme list' command during this window, the kernel attempts to gather connection information by calling getsockname() on the socket. Without proper validation, this results in dereferencing a NULL or invalid pointer, causing an immediate kernel crash. The race window is narrow, requiring error recovery to be actively cycling sockets when the list command executes. While this reliably causes crashes when the race is won, NULL pointer dereferences on modern kernels with SMAP/SMEP protections cannot be exploited for code execution or information disclosure, only denial of service.

Red Hat mitigation

To mitigate this issue, prevent the nvme_tcp module from loading. See https://access.redhat.com/solutions/41278 for instructions on blacklisting kernel modules.