CVE-2024-45013 nvme: move stopping keep-alive into nvme_uninit_ctrl()
A use-after-free in the Linux kernel NVMe driver can cause a kernel panic when the driver is unloaded after a connection failure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-45013?
CVE-2024-45013 is a critical use after free vulnerability in Linux kernel, published on 11 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nvme: move stopping keep-alive into nvme_uninit_ctrl()
Commit 4733b65d82bd ("nvme: start keep-alive after admin queue setup") moves starting keep-alive from nvme_start_ctrl() into nvme_init_ctrl_finish(), but don't move stopping keep-alive into nvme_uninit_ctrl(), so keep-alive work can be started and keep pending after failing to start controller, finally use-after-free is triggered if nvme host driver is unloaded.
This patch fixes kernel panic when running nvme/004 in case that connection failure is triggered, by moving stopping keep-alive into nvme_uninit_ctrl().
This way is reasonable because keep-alive is now started in nvme_init_ctrl_finish().
Weakness: CWE-416
Which versions are affected by CVE-2024-45013?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-45013?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-45013 being exploited?
There is no known exploitation of CVE-2024-45013 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-45013, DEBIAN-CVE-2024-45013, GHSA-4j5q-jrmv-h6pp, UBUNTU-CVE-2024-45013.