CVE-2023-53852

Vulnerability

Analysis

The vulnerability is a memory leak in the Linux kernel's NVMe core subsystem, specifically in the nvme_ctrl_dhchap_secret_store() function. This function is responsible for storing DHCHAP (Diffie-Hellman Challenge Handshake Authentication Protocol) secrets used for NVMe over Fabrics authentication. The leak occurs because the function allocates memory for the secret string but fails to free it when the operation completes or encounters an error, resulting in unreferenced memory objects [1].

The kernel memory leak can be triggered by writing DHCHAP secrets via the sysfs interface (/sys/class/nvme/nvmeX/dhchap_secret). Each write operation allocates a new copy of the secret string using kmalloc, but the allocated memory is not released after use. Over time, repeated writes cause the kernel to accumulate multiple copies of the secret, consuming memory without bound [1].

Impact & Mitigation

An attacker with local access or the ability to write to the sysfs attribute (which typically requires root or CAP_SYS_ADMIN privileges) can cause a gradual depletion of kernel memory. This can lead to system instability, denial of service, or potential out-of-memory conditions affecting other processes. The fix ensures that the allocated secret buffer is freed before returning from the function [1].

The patch has been merged into the Linux kernel stable tree. Users are advised to apply the patch corresponding to commit a836ca33c5b07d34dd5347af9f64d25651d12674 or update to a kernel version containing this fix [1].