CVE-2023-6356

NULL pointer dereference in nvmet_tcp_build_iovec

References

• https://bugzilla.redhat.com/show_bug.cgi?id=2254054
• https://lore.kernel.org/linux-nvme/CAK5usQupQgYoyav2itYADv2XVooMptqqswW8cTkuoMkRpjapwQ@mail.gmail.com/T/#t

Notes

 bwh> There has never been a nvmet_tcp_build_iovec() function in
 bwh> nvmet, but I think this is fixed by commit efa56305908b
 bwh> "nvmet-tcp: Fix a kernel panic when host sends an invalid
 bwh> H2C PDU length" which mentions nvmet_tcp_build_pdu_iovec().
 bwh> Fixed as well in 6.6.14 and 6.7.2.

Bugs

Status