In the Linux kernel, the following vulnerability has been resolved:
nvmet: fix freeing unallocated p2pmem
In case p2p device was found but the p2p pool is empty, the nvme target is still trying to free the sgl from the p2p pool instead of the regular sgl pool and causing a crash (BUG() is called). Instead, assign the p2p_dev for the request only if it was allocated from p2p pool.
This is the crash that was caused:
[Sun May 30 19:13:53 2021] ------------[ cut here ]------------ [Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518! [Sun May 30 19:13:53 2021] invalid opcode: 0000 [#1] SMP PTI ... [Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518! ... [Sun May 30 19:13:53 2021] RIP: 0010:gen_pool_free_owner+0xa8/0xb0 ... [Sun May 30 19:13:53 2021] Call Trace: [Sun May 30 19:13:53 2021] ------------[ cut here ]------------ [Sun May 30 19:13:53 2021] pci_free_p2pmem+0x2b/0x70 [Sun May 30 19:13:53 2021] pci_p2pmem_free_sgl+0x4f/0x80 [Sun May 30 19:13:53 2021] nvmet_req_free_sgls+0x1e/0x80 [nvmet] [Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518! [Sun May 30 19:13:53 2021] nvmet_rdma_release_rsp+0x4e/0x1f0 [nvmet_rdma] [Sun May 30 19:13:53 2021] nvmet_rdma_send_done+0x1c/0x60 [nvmet_rdma]
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-develUpgrade perf-debuginfoUpgrade perfUpgrade kernel-headersUpgrade kernel-debuginfoUpgrade python-perf-debuginfoUpgrade bpftoolUpgrade kernel-tools-debuginfoUpgrade kernel-toolsUpgrade kernel-debuginfo-common-aarch64Upgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade python-perfUpgrade kernel-devel | Aug 2, 2024 | Mar 15, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Mar 15, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 15, 2024 |
| Suse | — | Upgrade kernel-64kbUpgrade kernel-sourceUpgrade kernel-preempt-develUpgrade kernel-obs-buildUpgrade kernel-default-develUpgrade kernel-zfcpdumpUpgrade reiserfs-kmp-defaultUpgrade kernel-default-baseUpgrade kernel-docsUpgrade kernel-macrosUpgrade kernel-preemptUpgrade kernel-develUpgrade kernel-symsUpgrade kernel-64kb-develUpgrade kernel-default | Aug 9, 2024 | Mar 15, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub