Linux kernel - NVMe/TCP host (initiator), drivers/nvme/host/tcp.c: TENANT ISOLATION: nvme_tcp_recv_pdu()

Impact

TENANT ISOLATION: nvme_tcp_recv_pdu() did not validate the PDU header length, so with header digests enabled a target can send a packet declaring an invalid header length (for example 255) and make nvme_tcp_verify_hdgst() access memory outside the allocation and overwrite it with the calculated digest. The attack direction is target-to-initiator: a compromised or rogue storage target corrupts kernel memory on every GPU compute node that mounts from it. One storage compromise becomes fleet-wide kernel compromise, and header digests - a data-integrity feature operators turn on deliberately - are the precondition.

Who can reach it

The attacker controls an NVMe/TCP target the victim connects to, or can spoof/inject into that TCP connection, and returns a PDU with an out-of-range header length. Because NVMe/TCP has no transport authentication by default, an on-path attacker or anyone who can win a race to the discovery address can pose as the target.

What to do

Host reboot / kernel upgrade on all NVMe/TCP initiator nodes - that is the GPU compute fleet, not just storage, so plan a full rolling drain. Immediate mitigations: disable header digests on affected initiators (nvme connect option, applied on reconnect, no reboot) to remove the precondition, and enable TLS for NVMe/TCP where supported so the target's identity is proven. Also verify that discovery addresses cannot be hijacked on the storage network.

References