CVE-2024-45013
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In the Linux kernel, there is a use-after-free vulnerability in the NVMe driver. The issue is that stopping the keep-alive mechanism was not moved into nvme_uninit_ctrl(), which can lead to keep-alive work being started and left pending after a controller start failure, and then to use-after-free when the host driver is unloaded.
Risk Assessment
The vulnerability can cause a kernel panic in case of connection failure, potentially leading to system or service unavailability.
Recommendation
Apply a Linux kernel update containing the fix that moves stopping keep-alive into nvme_uninit_ctrl().
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: nvme: move stopping keep-alive into nvme_uninit_ctrl() Commit 4733b65d82bd ("nvme: start keep-alive after admin queue setup") moves starting keep-alive from nvme_start_ctrl() into nvme_init_ctrl_finish(), but don't move stopping keep-alive into nvme_uninit_ctrl(), so keep-alive work can be started and keep pending after failing to start controller, finally use-after-free is triggered if nvme host driver is unloaded. This patch fixes kernel panic when running nvme/004 in case that connection failure is triggered, by moving stopping keep-alive into nvme_uninit_ctrl(). This way is reasonable because keep-alive is now started in nvme_init_ctrl_finish().