SPDK (Storage Performance Development Kit) 25.05 - NVMe-oF target, lib/nvmf: A buffer overflow in the NVMe-oF target

Impact

A buffer overflow in the NVMe-oF target component of SPDK 25.05. SPDK is the userspace, poll-mode NVMe-oF target most commonly deployed by neoclouds and storage vendors precisely because it outperforms the kernel target, so it fronts tenant namespaces in exactly the environments this database is aimed at. NVD scores it as requiring high privileges with limited integrity impact plus availability loss, so the realistic outcome is a target crash - taking every attached tenant's I/O with it - rather than a clean takeover. Worth tracking because NeVerMore separately verified seven NVMe-oF protocol attacks against SPDK, so the target's overall exposure is broader than this single defect.

Who can reach it

Reached through the NVMe-oF target path in lib/nvmf on SPDK 25.05. NVD's vector puts it at network-adjacent reachability with high privileges required, which in practice means an authenticated or otherwise privileged initiator context rather than an anonymous peer. Public detail is thin - the advisory text is a one-line description with no reproducer.

What to do

Upgrade SPDK past 25.05 and restart the target process - no kernel change, no host reboot, but the restart drops all NVMe-oF connections, so run it behind multipath initiators or during a maintenance window per storage node. Combine with the NVMe-oF hardening in the discovery-controller entry: in-band DH-HMAC-CHAP, per-subsystem host allow-lists, and discovery on a management-only interface. Since SPDK is a library embedded in vendor and in-house appliances, check with your storage vendor which SPDK release their firmware ships rather than assuming the host package version is what is running.

References