Linux kernel - NVMe-oF target configfs, drivers/nvme/target/configfs.c: TENANT ISOLATION

Impact

TENANT ISOLATION: nvmet_root_discovery_nqn_store() treated the subsystem NQN string as a fixed-size buffer even though it is dynamically allocated to the length of the existing string, so writing a longer discovery NQN overflows the allocation. The direct exposure is local to whoever administers the target's configfs, but in an operator context that includes storage orchestration and CSI drivers running with elevated privileges - so a compromised control-plane component turns a configuration write into kernel memory corruption on the node holding every tenant's namespaces. It also matters because NQN handling is exactly the surface an attacker probes when attempting NQN spoofing.

Who can reach it

Write an over-long NQN string to the discovery subsystem's configfs attribute on the target. Requires privileged access to the target host's configfs, which orchestration and storage-management agents routinely have. Not remotely reachable on its own, but a natural second stage after compromising a storage control-plane component.

What to do

Host reboot / kernel upgrade on nvmet target nodes; fold into the same window as the other nvmet findings rather than scheduling separately. Config-side hardening that pays off regardless: keep the target's configfs off any path an untrusted orchestration component can reach, and audit which service accounts can write nvmet configuration.

References