NVME_IOCTL_IO_CMD and the io_uring passthrough path have never checked
the user-supplied metadata length against the number of blocks and the
namespace metadata size that the device uses to size the transfer, so
the device can DMA past the end of the buffer. 855b7717f44b ("nvme:
fine-granular CAP_SYS_ADMIN for nvme io commands", v6.2) let users with
write access to the device node issue the ioctl, turning the missing
check into an exposure; kernels before v6.2 are not affected, as Debian
concluded independently:https://security-tracker.debian.org/tracker/CVE-2023-6238 A fix removing unprivileged passthrough was proposed but not merged to mainline, and nvme_map_user_request() still passes the metadata length to blk_rq_integrity_map_user() with no cross-check: https://lore.kernel.org/linux-nvme/[email protected]/ CC: Paul Barker <[email protected]> AI-Generated: Uses Claude (claude-opus-5) Signed-off-by: Junjie Cao <[email protected]> --- v4: - rework the explanation around 855b7717f44b making the ioctl reachable, per review; drop the applied-then-backed-out narrative - status reads "Proposed fix was not merged" rather than "withdrawn", as flagged on the v3 thread: the fix was backed out by the nvme maintainer, not withdrawn by its author v3: https://lore.kernel.org/openembedded-core/[email protected]/ meta/recipes-kernel/linux/cve-exclusion.inc | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc index a133bf08..4729191a 100644 --- a/meta/recipes-kernel/linux/cve-exclusion.inc +++ b/meta/recipes-kernel/linux/cve-exclusion.inc @@ -240,3 +240,13 @@ CVE_STATUS[CVE-2022-4543] = "unpatched: No fix has been proposed" # https://security-tracker.debian.org/tracker/CVE-2023-3397 # https://ubuntu.com/security/CVE-2023-3397 CVE_STATUS[CVE-2023-3397] = "unpatched: Proposed fix was withdrawn" + +# Triaged August 2026 - Issue was introduced by kernel commit 855b7717f44b +# ("nvme: fine-granular CAP_SYS_ADMIN for nvme io commands") in Linux v6.2. +# Linux 6.1 and earlier not affected. Unfixed in recent Debian/Ubuntu releases +# which use affected kernels. There was a fix proposed, but it was not merged +# to mainline. +# https://security-tracker.debian.org/tracker/CVE-2023-6238 +# https://ubuntu.com/security/CVE-2023-6238 +# https://lore.kernel.org/linux-nvme/[email protected]/ +CVE_STATUS[CVE-2023-6238] = "unpatched: Proposed fix was not merged" -- 2.43.0
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#244053): https://lists.openembedded.org/g/openembedded-core/message/244053 Mute This Topic: https://lists.openembedded.org/mt/120897567/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
