In the Linux kernel, the following vulnerability has been resolved:
nvmet: always initialize cqe.result
The spec doesn't mandate that the first two double words (aka results) for the command queue entry need to be set to 0 when they are not used (not specified). Though, the target implemention returns 0 for TCP and FC but not for RDMA.
Let's make RDMA behave the same and thus explicitly initializing the result field. This prevents leaking any data from the stack.
[
{
"id": "CVE-2024-41079-1a1a078e",
"target": {
"file": "drivers/nvme/target/fabrics-cmd-auth.c",
"function": "nvmet_execute_auth_send"
},
"digest": {
"length": 4973.0,
"function_hash": "259085806952262196467288639340632471503"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10967873b80742261527a071954be8b54f0f8e4d",
"signature_version": "v1"
},
{
"id": "CVE-2024-41079-2442cbd0",
"target": {
"file": "drivers/nvme/target/fabrics-cmd.c",
"function": "nvmet_execute_io_connect"
},
"digest": {
"length": 1418.0,
"function_hash": "34520606375798895350172904158509010950"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd0c1b8e045a8d2785342b385cb2684d9b48e426",
"signature_version": "v1"
},
{
"id": "CVE-2024-41079-5107b779",
"target": {
"file": "drivers/nvme/target/fabrics-cmd-auth.c",
"function": "nvmet_execute_auth_receive"
},
"digest": {
"length": 2890.0,
"function_hash": "151550297659518789366769096256501320026"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd0c1b8e045a8d2785342b385cb2684d9b48e426",
"signature_version": "v1"
},
{
"id": "CVE-2024-41079-68d8aeb8",
"target": {
"file": "drivers/nvme/target/fabrics-cmd.c",
"function": "nvmet_execute_admin_connect"
},
"digest": {
"length": 1933.0,
"function_hash": "253192332849644177015643874381452313672"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd0c1b8e045a8d2785342b385cb2684d9b48e426",
"signature_version": "v1"
},
{
"id": "CVE-2024-41079-7f0361f7",
"target": {
"file": "drivers/nvme/target/core.c",
"function": "nvmet_req_init"
},
"digest": {
"length": 1401.0,
"function_hash": "325848432887848869612774658573362143321"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10967873b80742261527a071954be8b54f0f8e4d",
"signature_version": "v1"
},
{
"id": "CVE-2024-41079-8e48b2c0",
"target": {
"file": "drivers/nvme/target/fabrics-cmd-auth.c",
"function": "nvmet_execute_auth_send"
},
"digest": {
"length": 4945.0,
"function_hash": "222603597704549239819531521323012287727"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd0c1b8e045a8d2785342b385cb2684d9b48e426",
"signature_version": "v1"
},
{
"id": "CVE-2024-41079-97a9f180",
"target": {
"file": "drivers/nvme/target/fabrics-cmd-auth.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"112391120638373980608474596867769419030",
"104186987865251216381336498383419760122",
"315513477493103695050691967599316957298",
"190807639543388882906330718284700431435",
"25282184098579665385131525205289629452",
"157024806440135262744875692377671490938",
"244681311367993498558851313444332159690",
"214110245362047436074702254925682716413"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd0c1b8e045a8d2785342b385cb2684d9b48e426",
"signature_version": "v1"
},
{
"id": "CVE-2024-41079-a72d386d",
"target": {
"file": "drivers/nvme/target/fabrics-cmd.c",
"function": "nvmet_execute_admin_connect"
},
"digest": {
"length": 1987.0,
"function_hash": "295158965270823846097195387200028780294"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10967873b80742261527a071954be8b54f0f8e4d",
"signature_version": "v1"
},
{
"id": "CVE-2024-41079-aa6e6cea",
"target": {
"file": "drivers/nvme/target/core.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"90560870040463340785712026534965071033",
"128226732339811513356763134313840867580",
"62919740522492389536200282627712500314",
"131228740142762349724965002014941306423"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd0c1b8e045a8d2785342b385cb2684d9b48e426",
"signature_version": "v1"
},
{
"id": "CVE-2024-41079-b5faef92",
"target": {
"file": "drivers/nvme/target/fabrics-cmd-auth.c",
"function": "nvmet_execute_auth_receive"
},
"digest": {
"length": 2890.0,
"function_hash": "151550297659518789366769096256501320026"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10967873b80742261527a071954be8b54f0f8e4d",
"signature_version": "v1"
},
{
"id": "CVE-2024-41079-c5fcc4c9",
"target": {
"file": "drivers/nvme/target/core.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"90560870040463340785712026534965071033",
"128226732339811513356763134313840867580",
"62919740522492389536200282627712500314",
"131228740142762349724965002014941306423"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10967873b80742261527a071954be8b54f0f8e4d",
"signature_version": "v1"
},
{
"id": "CVE-2024-41079-cfa3b104",
"target": {
"file": "drivers/nvme/target/fabrics-cmd.c",
"function": "nvmet_execute_io_connect"
},
"digest": {
"length": 1422.0,
"function_hash": "200803940463245990346151125150653909381"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10967873b80742261527a071954be8b54f0f8e4d",
"signature_version": "v1"
},
{
"id": "CVE-2024-41079-d497e5cb",
"target": {
"file": "drivers/nvme/target/fabrics-cmd.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"10979400610069544811239835313304110854",
"313536730399618929285881545336089564972",
"183871216893357566024190216358724796966",
"307419015397274515962122641858702202471",
"10979400610069544811239835313304110854",
"313536730399618929285881545336089564972",
"183871216893357566024190216358724796966",
"307419015397274515962122641858702202471"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10967873b80742261527a071954be8b54f0f8e4d",
"signature_version": "v1"
},
{
"id": "CVE-2024-41079-dc6874f9",
"target": {
"file": "drivers/nvme/target/core.c",
"function": "nvmet_req_init"
},
"digest": {
"length": 1401.0,
"function_hash": "325848432887848869612774658573362143321"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd0c1b8e045a8d2785342b385cb2684d9b48e426",
"signature_version": "v1"
},
{
"id": "CVE-2024-41079-e158e403",
"target": {
"file": "drivers/nvme/target/fabrics-cmd-auth.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"112391120638373980608474596867769419030",
"104186987865251216381336498383419760122",
"315513477493103695050691967599316957298",
"190807639543388882906330718284700431435",
"25282184098579665385131525205289629452",
"157024806440135262744875692377671490938",
"244681311367993498558851313444332159690",
"214110245362047436074702254925682716413"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10967873b80742261527a071954be8b54f0f8e4d",
"signature_version": "v1"
},
{
"id": "CVE-2024-41079-f437f936",
"target": {
"file": "drivers/nvme/target/fabrics-cmd.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"10979400610069544811239835313304110854",
"313536730399618929285881545336089564972",
"183871216893357566024190216358724796966",
"307419015397274515962122641858702202471",
"10979400610069544811239835313304110854",
"313536730399618929285881545336089564972",
"183871216893357566024190216358724796966",
"307419015397274515962122641858702202471"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd0c1b8e045a8d2785342b385cb2684d9b48e426",
"signature_version": "v1"
}
]