cbcvebase.
CVE-2023-5178
published 2023-11-01

CVE-2023-5178: A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux…

PriorityP264high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
9.14%
94.8th percentile
A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation.

Affected

19 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.64-1 (bookworm)linux 6.1.64-1 (bookworm)
linuxlinux_kernel>= 0 < 5.10.205-25.10.205-2
linuxlinux_kernel>= 0 < 6.1.64-16.1.64-1
linuxlinux_kernel>= 0 < 6.5.8-16.5.8-1
linuxlinux_kernel>= 0 < 6.5.8-16.5.8-1
linuxlinux_kernel>= 0 < 5.4.0-169.1875.4.0-169.187
linuxlinux_kernel>= 0 < 5.15.0-91.1015.15.0-91.101
linuxlinux_kernel>= 5.0 < 5.4.2605.4.260
linuxlinux_kernel>= 5.11 < 5.15.1375.15.137
linuxlinux_kernel>= 5.16 < 6.1.606.1.60
linuxlinux_kernel>= 5.5 < 5.10.1995.10.199
linuxlinux_kernel>= 6.2 < 6.5.96.5.9
msrccbl2_hyperv-daemons_5.15.137.1-1_on_cbl_mariner_2.0
msrccbl2_kernel_5.15.138.1-4_on_cbl_mariner_2.0
paloaltopan-os
redhatenterprise_linux
redhatenterprise_linux
ubuntulinux-gcp
ubuntulinux-kvm

Detection & IOCsextracted from sources · hover to see the quote

  • Vulnerability is only exploitable on systems where NVMe over TCP (NVMe-oF/TCP) is actively in use; scope detection to hosts with NVMe/TCP enabled
  • The vulnerable code path is in drivers/nvme/target/tcp.c, specifically in the nvmet_tcp_free_crypto function; monitor kernel crash/UAF reports originating from this function
  • The vulnerability can be triggered remotely via queue initialization failures in NVMe-oF/TCP; monitor for anomalous NVMe-oF/TCP connection attempts or queue setup errors from untrusted sources
  • Upstream patch reference available for signature/diff-based detection; review the patch at the linked lore.kernel.org thread
  • ·Exploitation requires NVMe-oF/TCP to be in use; systems not running NVMe over TCP are not affected
  • ·Remote exploitation is possible (denial of service or RCE); local privilege escalation is also a potential outcome if the attacker already has local access
  • ·Red Hat Enterprise Linux 6 and 7 (including kernel-rt) are confirmed not affected; RHEL 8 and 9 (including kernel-rt on RHEL 9) are affected

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_debian8.8HIGH
vendor_msrc8.8HIGH
vendor_redhat8.8HIGH
vendor_ubuntu6.0MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.