Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: nvme-fabrics: fix DHCHAP secret leak on parse failure nvmf_parse_options() duplicates dhchap_secret and dhchap_ctrl_secret with match_strdup() before validating the DHHC-1: representation. If validation fails, the parser returns -EINVAL before the temporary string in p is assigned to opts->dhchap_secret or opts->dhchap_ctrl_secret. nvmf_create_ctrl() subsequently frees opts, but nvmf_free_options() cannot release the unassigned temporary string. Each rejected option therefore leaks one allocation. This is easy to miss because valid secrets transfer ownership to opts and are freed normally, while the malformed-secret path still returns the expected -EINVAL to userspace. With CONFIG_NVME_HOST_AUTH enabled, the leak is reachable before the required-option checks and transport lookup. No NVMe-oF target or working transport connection is required; for example, repeatedly writing dhchap_secret=BAD or dhchap_ctrl_secret=BAD to /dev/nvme-fabrics deterministically takes the leaking parse path. Free the temporary string before leaving both validation error paths. Use kfree_sensitive() because the copied option may contain secret material even when its representation is rejected, matching the sensitive cleanup used for stored DHCHAP secrets.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected f50fff73d620cd6e8f48bc58d4f1c944615a3fea before 3ce0e9b43f355dfa0bdc0e0dd889795752285791; affected f50fff73d620cd6e8f48bc58d4f1c944615a3fea before 702c1ae0d31b44828ec3c87079def490c1ee1fb3; affected f50fff73d620cd6e8f48bc58d4f1c944615a3fea before 15d7a35a489287109b5a7c157d53d9b8214f0318; affected f50fff73d620cd6e8f48bc58d4f1c944615a3fea before d21da6cc91ba1c4f1ae5ba007f3cb89e1c0c7549; affected f50fff73d620cd6e8f48bc58d4f1c944615a3fea before afdee49a1b88ed9bb44e2b30e855297c169bcc53 |
| Linux / Linux | affected 6.0; unaffected 0 before 6.0; unaffected 6.6.160 through 6.6.*; unaffected 6.12.110 through 6.12.*; unaffected 6.18.51 through 6.18.*; unaffected 7.2.5 through 7.2.*; unaffected 7.3 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/3ce0e9b43f355dfa0bdc0e0dd889795752285791
- https://git.kernel.org/stable/c/702c1ae0d31b44828ec3c87079def490c1ee1fb3
- https://git.kernel.org/stable/c/15d7a35a489287109b5a7c157d53d9b8214f0318
- https://git.kernel.org/stable/c/d21da6cc91ba1c4f1ae5ba007f3cb89e1c0c7549
- https://git.kernel.org/stable/c/afdee49a1b88ed9bb44e2b30e855297c169bcc53