Better handling of dh_key in nvmet-auth to avoid double free

CVE-2024-50215

What is CVE-2024-50215?

A vulnerability in the nvmet-auth module of the Linux kernel relates to the improper management of the dh_key variable following its release. This oversight could lead to the potential for a double free vulnerability in the nvmet_destroy_auth() function. When the dh_key is not nullified after the kfree_sensitive operation, it may be utilized across multiple calls to nvmet_setup_dhgroup() for the same controller. This flaw can result in unintended behavior and stability issues within NVM Express (NVMe) storage controllers, necessitating prompt attention from system administrators to mitigate potential impacts on data integrity and system performance.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References