Linux kernel - NVMe-oF TCP target, drivers/nvme/target/tcp.c: A host sending an H2CData command with a DATAL

Impact

A host sending an H2CData command with a DATAL inconsistent with the packet size drives a NULL pointer dereference in nvmet_tcp_build_pdu_iovec() and panics the target kernel. The PDU length was also never checked against the MAXH2CDATA value the target itself advertised during connection setup. On a storage node serving many GPU tenants, one malformed PDU from one tenant takes the node down and every attached volume with it - and since NVMe/TCP is unauthenticated by default, the attacker does not need to be a tenant at all, just reachable.

Who can reach it

Connect to the NVMe/TCP target and send an H2CData PDU whose DATAL does not match the actual packet size, or which exceeds the negotiated MAXH2CDATA. Trivial to construct, instantly fatal to the target, and repeatable after every reboot until patched.

What to do

Host reboot / kernel upgrade on nvmet-tcp targets. Interim: restrict port 4420 to known initiator addresses and enable in-band authentication (on a patched kernel) so an arbitrary peer cannot reach the PDU parser. If a storage node is serving production tenants and cannot be rebooted immediately, the firewall restriction is the meaningful control - this is remotely triggerable with no state.

References