CVE-2024-42152 (GCVE-0-2024-42152)

Vulnerability from cvelistv5 – Published: 2024-07-30 07:46 – Updated: 2026-05-11 20:27
VLAI
Title
nvmet: fix a possible leak when destroy a ctrl during qp establishment
Summary
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix a possible leak when destroy a ctrl during qp establishment In nvmet_sq_destroy we capture sq->ctrl early and if it is non-NULL we know that a ctrl was allocated (in the admin connect request handler) and we need to release pending AERs, clear ctrl->sqs and sq->ctrl (for nvme-loop primarily), and drop the final reference on the ctrl. However, a small window is possible where nvmet_sq_destroy starts (as a result of the client giving up and disconnecting) concurrently with the nvme admin connect cmd (which may be in an early stage). But *before* kill_and_confirm of sq->ref (i.e. the admin connect managed to get an sq live reference). In this case, sq->ctrl was allocated however after it was captured in a local variable in nvmet_sq_destroy. This prevented the final reference drop on the ctrl. Solve this by re-capturing the sq->ctrl after all inflight request has completed, where for sure sq->ctrl reference is final, and move forward based on that. This issue was observed in an environment with many hosts connecting multiple ctrls simoutanuosly, creating a delay in allocating a ctrl leading up to this race window.
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 0f5be6a4ff7b3f8bf3db15f904e3e76797a43d9a , < 2f3c22b1d3d7e86712253244797a651998c141fa (git)
Affected: 0f5be6a4ff7b3f8bf3db15f904e3e76797a43d9a , < b4fed1443a6571d49c6ffe7d97af3bbe5ee6dff5 (git)
Affected: 0f5be6a4ff7b3f8bf3db15f904e3e76797a43d9a , < 940a71f08ef153ef807f751310b0648d1fa5d0da (git)
Affected: 0f5be6a4ff7b3f8bf3db15f904e3e76797a43d9a , < 5502c1f1d0d7472706cc1f201aecf1c935d302d1 (git)
Affected: 0f5be6a4ff7b3f8bf3db15f904e3e76797a43d9a , < 818004f2a380420c19872171be716174d4985e33 (git)
Affected: 0f5be6a4ff7b3f8bf3db15f904e3e76797a43d9a , < c758b77d4a0a0ed3a1292b3fd7a2aeccd1a169a4 (git)
Create a notification for this product.
Linux Linux Affected: 5.6
Unaffected: 0 , < 5.6 (semver)
Unaffected: 5.10.222 , ≤ 5.10.* (semver)
Unaffected: 5.15.163 , ≤ 5.15.* (semver)
Unaffected: 6.1.98 , ≤ 6.1.* (semver)
Unaffected: 6.6.39 , ≤ 6.6.* (semver)
Unaffected: 6.9.9 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:02:15.586Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2f3c22b1d3d7e86712253244797a651998c141fa"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b4fed1443a6571d49c6ffe7d97af3bbe5ee6dff5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/940a71f08ef153ef807f751310b0648d1fa5d0da"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5502c1f1d0d7472706cc1f201aecf1c935d302d1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/818004f2a380420c19872171be716174d4985e33"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c758b77d4a0a0ed3a1292b3fd7a2aeccd1a169a4"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42152",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:15:21.603444Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:34.451Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2f3c22b1d3d7e86712253244797a651998c141fa",
              "status": "affected",
              "version": "0f5be6a4ff7b3f8bf3db15f904e3e76797a43d9a",
              "versionType": "git"
            },
            {
              "lessThan": "b4fed1443a6571d49c6ffe7d97af3bbe5ee6dff5",
              "status": "affected",
              "version": "0f5be6a4ff7b3f8bf3db15f904e3e76797a43d9a",
              "versionType": "git"
            },
            {
              "lessThan": "940a71f08ef153ef807f751310b0648d1fa5d0da",
              "status": "affected",
              "version": "0f5be6a4ff7b3f8bf3db15f904e3e76797a43d9a",
              "versionType": "git"
            },
            {
              "lessThan": "5502c1f1d0d7472706cc1f201aecf1c935d302d1",
              "status": "affected",
              "version": "0f5be6a4ff7b3f8bf3db15f904e3e76797a43d9a",
              "versionType": "git"
            },
            {
              "lessThan": "818004f2a380420c19872171be716174d4985e33",
              "status": "affected",
              "version": "0f5be6a4ff7b3f8bf3db15f904e3e76797a43d9a",
              "versionType": "git"
            },
            {
              "lessThan": "c758b77d4a0a0ed3a1292b3fd7a2aeccd1a169a4",
              "status": "affected",
              "version": "0f5be6a4ff7b3f8bf3db15f904e3e76797a43d9a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.98",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.222",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.163",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.98",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.39",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.9",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix a possible leak when destroy a ctrl during qp establishment\n\nIn nvmet_sq_destroy we capture sq-\u003ectrl early and if it is non-NULL we\nknow that a ctrl was allocated (in the admin connect request handler)\nand we need to release pending AERs, clear ctrl-\u003esqs and sq-\u003ectrl\n(for nvme-loop primarily), and drop the final reference on the ctrl.\n\nHowever, a small window is possible where nvmet_sq_destroy starts (as\na result of the client giving up and disconnecting) concurrently with\nthe nvme admin connect cmd (which may be in an early stage). But *before*\nkill_and_confirm of sq-\u003eref (i.e. the admin connect managed to get an sq\nlive reference). In this case, sq-\u003ectrl was allocated however after it was\ncaptured in a local variable in nvmet_sq_destroy.\nThis prevented the final reference drop on the ctrl.\n\nSolve this by re-capturing the sq-\u003ectrl after all inflight request has\ncompleted, where for sure sq-\u003ectrl reference is final, and move forward\nbased on that.\n\nThis issue was observed in an environment with many hosts connecting\nmultiple ctrls simoutanuosly, creating a delay in allocating a ctrl\nleading up to this race window."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:27:58.252Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2f3c22b1d3d7e86712253244797a651998c141fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/b4fed1443a6571d49c6ffe7d97af3bbe5ee6dff5"
        },
        {
          "url": "https://git.kernel.org/stable/c/940a71f08ef153ef807f751310b0648d1fa5d0da"
        },
        {
          "url": "https://git.kernel.org/stable/c/5502c1f1d0d7472706cc1f201aecf1c935d302d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/818004f2a380420c19872171be716174d4985e33"
        },
        {
          "url": "https://git.kernel.org/stable/c/c758b77d4a0a0ed3a1292b3fd7a2aeccd1a169a4"
        }
      ],
      "title": "nvmet: fix a possible leak when destroy a ctrl during qp establishment",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42152",
    "datePublished": "2024-07-30T07:46:44.795Z",
    "dateReserved": "2024-07-29T15:50:41.193Z",
    "dateUpdated": "2026-05-11T20:27:58.252Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-42152",
      "date": "2026-06-14",
      "epss": "0.00032",
      "percentile": "0.09874"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.8\", \"versionEndExcluding\": \"5.10.222\", \"matchCriteriaId\": \"6A024C9F-1F70-4EB4-B7D0-432011590CAB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.15.163\", \"matchCriteriaId\": \"A97DEB09-4927-40F8-B5C6-F5BD5EAE0CFD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.98\", \"matchCriteriaId\": \"E09E92A5-27EF-40E4-926A-B1CDC8270551\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.39\", \"matchCriteriaId\": \"29E894E4-668F-4DB0-81F7-4FB5F698E970\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.9.9\", \"matchCriteriaId\": \"ADCC1407-0CB3-4C8F-B4C5-07F682CD7085\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"2EBB4392-5FA6-4DA9-9772-8F9C750109FA\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnvmet: fix a possible leak when destroy a ctrl during qp establishment\\n\\nIn nvmet_sq_destroy we capture sq-\u003ectrl early and if it is non-NULL we\\nknow that a ctrl was allocated (in the admin connect request handler)\\nand we need to release pending AERs, clear ctrl-\u003esqs and sq-\u003ectrl\\n(for nvme-loop primarily), and drop the final reference on the ctrl.\\n\\nHowever, a small window is possible where nvmet_sq_destroy starts (as\\na result of the client giving up and disconnecting) concurrently with\\nthe nvme admin connect cmd (which may be in an early stage). But *before*\\nkill_and_confirm of sq-\u003eref (i.e. the admin connect managed to get an sq\\nlive reference). In this case, sq-\u003ectrl was allocated however after it was\\ncaptured in a local variable in nvmet_sq_destroy.\\nThis prevented the final reference drop on the ctrl.\\n\\nSolve this by re-capturing the sq-\u003ectrl after all inflight request has\\ncompleted, where for sure sq-\u003ectrl reference is final, and move forward\\nbased on that.\\n\\nThis issue was observed in an environment with many hosts connecting\\nmultiple ctrls simoutanuosly, creating a delay in allocating a ctrl\\nleading up to this race window.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nvmet: corrige una posible fuga al destruir un ctrl durante el establecimiento de qp En nvmet_sq_destroy capturamos sq-\u0026gt;ctrl temprano y si no es NULL sabemos que se asign\\u00f3 un ctrl (en el controlador de solicitudes de conexi\\u00f3n de administrador) y necesitamos liberar los AER pendientes, borrar ctrl-\u0026gt;sqs y sq-\u0026gt;ctrl (principalmente para nvme-loop) y eliminar la referencia final en ctrl. Sin embargo, es posible una peque\\u00f1a ventana donde se inicia nvmet_sq_destroy (como resultado de que el cliente se rinde y se desconecta) al mismo tiempo que el cmd de conexi\\u00f3n del administrador de nvme (que puede estar en una etapa inicial). Pero *antes* de kill_and_confirm de sq-\u0026gt;ref (es decir, la conexi\\u00f3n del administrador logr\\u00f3 obtener una referencia en vivo de sq). En este caso, se asign\\u00f3 sq-\u0026gt;ctrl sin embargo despu\\u00e9s de ser capturado en una variable local en nvmet_sq_destroy. Esto evit\\u00f3 la ca\\u00edda de la referencia final en Ctrl. Resuelva esto volviendo a capturar sq-\u0026gt;ctrl despu\\u00e9s de que se hayan completado todas las solicitudes en curso, donde con seguridad la referencia sq-\u0026gt;ctrl es definitiva, y avance en funci\\u00f3n de eso. Este problema se observ\\u00f3 en un entorno con muchos hosts que conectaban m\\u00faltiples controles simult\\u00e1neamente, lo que creaba un retraso en la asignaci\\u00f3n de un control que conduc\\u00eda a esta ventana de ejecuci\\u00f3n.\"}]",
      "id": "CVE-2024-42152",
      "lastModified": "2024-11-21T09:33:42.533",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 4.7, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.0, \"impactScore\": 3.6}]}",
      "published": "2024-07-30T08:15:06.763",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/2f3c22b1d3d7e86712253244797a651998c141fa\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/5502c1f1d0d7472706cc1f201aecf1c935d302d1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/818004f2a380420c19872171be716174d4985e33\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/940a71f08ef153ef807f751310b0648d1fa5d0da\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/b4fed1443a6571d49c6ffe7d97af3bbe5ee6dff5\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/c758b77d4a0a0ed3a1292b3fd7a2aeccd1a169a4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/2f3c22b1d3d7e86712253244797a651998c141fa\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/5502c1f1d0d7472706cc1f201aecf1c935d302d1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/818004f2a380420c19872171be716174d4985e33\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/940a71f08ef153ef807f751310b0648d1fa5d0da\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/b4fed1443a6571d49c6ffe7d97af3bbe5ee6dff5\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/c758b77d4a0a0ed3a1292b3fd7a2aeccd1a169a4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-401\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-42152\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-30T08:15:06.763\",\"lastModified\":\"2025-11-03T22:17:43.050\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnvmet: fix a possible leak when destroy a ctrl during qp establishment\\n\\nIn nvmet_sq_destroy we capture sq-\u003ectrl early and if it is non-NULL we\\nknow that a ctrl was allocated (in the admin connect request handler)\\nand we need to release pending AERs, clear ctrl-\u003esqs and sq-\u003ectrl\\n(for nvme-loop primarily), and drop the final reference on the ctrl.\\n\\nHowever, a small window is possible where nvmet_sq_destroy starts (as\\na result of the client giving up and disconnecting) concurrently with\\nthe nvme admin connect cmd (which may be in an early stage). But *before*\\nkill_and_confirm of sq-\u003eref (i.e. the admin connect managed to get an sq\\nlive reference). In this case, sq-\u003ectrl was allocated however after it was\\ncaptured in a local variable in nvmet_sq_destroy.\\nThis prevented the final reference drop on the ctrl.\\n\\nSolve this by re-capturing the sq-\u003ectrl after all inflight request has\\ncompleted, where for sure sq-\u003ectrl reference is final, and move forward\\nbased on that.\\n\\nThis issue was observed in an environment with many hosts connecting\\nmultiple ctrls simoutanuosly, creating a delay in allocating a ctrl\\nleading up to this race window.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nvmet: corrige una posible fuga al destruir un ctrl durante el establecimiento de qp En nvmet_sq_destroy capturamos sq-\u0026gt;ctrl temprano y si no es NULL sabemos que se asign\u00f3 un ctrl (en el controlador de solicitudes de conexi\u00f3n de administrador) y necesitamos liberar los AER pendientes, borrar ctrl-\u0026gt;sqs y sq-\u0026gt;ctrl (principalmente para nvme-loop) y eliminar la referencia final en ctrl. Sin embargo, es posible una peque\u00f1a ventana donde se inicia nvmet_sq_destroy (como resultado de que el cliente se rinde y se desconecta) al mismo tiempo que el cmd de conexi\u00f3n del administrador de nvme (que puede estar en una etapa inicial). Pero *antes* de kill_and_confirm de sq-\u0026gt;ref (es decir, la conexi\u00f3n del administrador logr\u00f3 obtener una referencia en vivo de sq). En este caso, se asign\u00f3 sq-\u0026gt;ctrl sin embargo despu\u00e9s de ser capturado en una variable local en nvmet_sq_destroy. Esto evit\u00f3 la ca\u00edda de la referencia final en Ctrl. Resuelva esto volviendo a capturar sq-\u0026gt;ctrl despu\u00e9s de que se hayan completado todas las solicitudes en curso, donde con seguridad la referencia sq-\u0026gt;ctrl es definitiva, y avance en funci\u00f3n de eso. Este problema se observ\u00f3 en un entorno con muchos hosts que conectaban m\u00faltiples controles simult\u00e1neamente, lo que creaba un retraso en la asignaci\u00f3n de un control que conduc\u00eda a esta ventana de ejecuci\u00f3n.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.8\",\"versionEndExcluding\":\"5.10.222\",\"matchCriteriaId\":\"6A024C9F-1F70-4EB4-B7D0-432011590CAB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.163\",\"matchCriteriaId\":\"A97DEB09-4927-40F8-B5C6-F5BD5EAE0CFD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.98\",\"matchCriteriaId\":\"E09E92A5-27EF-40E4-926A-B1CDC8270551\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.39\",\"matchCriteriaId\":\"29E894E4-668F-4DB0-81F7-4FB5F698E970\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.9.9\",\"matchCriteriaId\":\"ADCC1407-0CB3-4C8F-B4C5-07F682CD7085\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"2EBB4392-5FA6-4DA9-9772-8F9C750109FA\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2f3c22b1d3d7e86712253244797a651998c141fa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5502c1f1d0d7472706cc1f201aecf1c935d302d1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/818004f2a380420c19872171be716174d4985e33\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/940a71f08ef153ef807f751310b0648d1fa5d0da\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b4fed1443a6571d49c6ffe7d97af3bbe5ee6dff5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c758b77d4a0a0ed3a1292b3fd7a2aeccd1a169a4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2f3c22b1d3d7e86712253244797a651998c141fa\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5502c1f1d0d7472706cc1f201aecf1c935d302d1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/818004f2a380420c19872171be716174d4985e33\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/940a71f08ef153ef807f751310b0648d1fa5d0da\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b4fed1443a6571d49c6ffe7d97af3bbe5ee6dff5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c758b77d4a0a0ed3a1292b3fd7a2aeccd1a169a4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/2f3c22b1d3d7e86712253244797a651998c141fa\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b4fed1443a6571d49c6ffe7d97af3bbe5ee6dff5\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/940a71f08ef153ef807f751310b0648d1fa5d0da\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/5502c1f1d0d7472706cc1f201aecf1c935d302d1\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/818004f2a380420c19872171be716174d4985e33\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c758b77d4a0a0ed3a1292b3fd7a2aeccd1a169a4\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:02:15.586Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-42152\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:15:21.603444Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:24.537Z\"}}], \"cna\": {\"title\": \"nvmet: fix a possible leak when destroy a ctrl during qp establishment\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"0f5be6a4ff7b3f8bf3db15f904e3e76797a43d9a\", \"lessThan\": \"2f3c22b1d3d7e86712253244797a651998c141fa\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0f5be6a4ff7b3f8bf3db15f904e3e76797a43d9a\", \"lessThan\": \"b4fed1443a6571d49c6ffe7d97af3bbe5ee6dff5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0f5be6a4ff7b3f8bf3db15f904e3e76797a43d9a\", \"lessThan\": \"940a71f08ef153ef807f751310b0648d1fa5d0da\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0f5be6a4ff7b3f8bf3db15f904e3e76797a43d9a\", \"lessThan\": \"5502c1f1d0d7472706cc1f201aecf1c935d302d1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0f5be6a4ff7b3f8bf3db15f904e3e76797a43d9a\", \"lessThan\": \"818004f2a380420c19872171be716174d4985e33\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0f5be6a4ff7b3f8bf3db15f904e3e76797a43d9a\", \"lessThan\": \"c758b77d4a0a0ed3a1292b3fd7a2aeccd1a169a4\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/nvme/target/core.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.6\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.222\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.163\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.98\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.39\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/nvme/target/core.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/2f3c22b1d3d7e86712253244797a651998c141fa\"}, {\"url\": \"https://git.kernel.org/stable/c/b4fed1443a6571d49c6ffe7d97af3bbe5ee6dff5\"}, {\"url\": \"https://git.kernel.org/stable/c/940a71f08ef153ef807f751310b0648d1fa5d0da\"}, {\"url\": \"https://git.kernel.org/stable/c/5502c1f1d0d7472706cc1f201aecf1c935d302d1\"}, {\"url\": \"https://git.kernel.org/stable/c/818004f2a380420c19872171be716174d4985e33\"}, {\"url\": \"https://git.kernel.org/stable/c/c758b77d4a0a0ed3a1292b3fd7a2aeccd1a169a4\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnvmet: fix a possible leak when destroy a ctrl during qp establishment\\n\\nIn nvmet_sq_destroy we capture sq-\u003ectrl early and if it is non-NULL we\\nknow that a ctrl was allocated (in the admin connect request handler)\\nand we need to release pending AERs, clear ctrl-\u003esqs and sq-\u003ectrl\\n(for nvme-loop primarily), and drop the final reference on the ctrl.\\n\\nHowever, a small window is possible where nvmet_sq_destroy starts (as\\na result of the client giving up and disconnecting) concurrently with\\nthe nvme admin connect cmd (which may be in an early stage). But *before*\\nkill_and_confirm of sq-\u003eref (i.e. the admin connect managed to get an sq\\nlive reference). In this case, sq-\u003ectrl was allocated however after it was\\ncaptured in a local variable in nvmet_sq_destroy.\\nThis prevented the final reference drop on the ctrl.\\n\\nSolve this by re-capturing the sq-\u003ectrl after all inflight request has\\ncompleted, where for sure sq-\u003ectrl reference is final, and move forward\\nbased on that.\\n\\nThis issue was observed in an environment with many hosts connecting\\nmultiple ctrls simoutanuosly, creating a delay in allocating a ctrl\\nleading up to this race window.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.222\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.163\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.98\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.39\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.9\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"5.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-06-19T12:56:36.697Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-42152\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-03T22:02:15.586Z\", \"dateReserved\": \"2024-07-29T15:50:41.193Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-30T07:46:44.795Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.