Vulnerability · Published Nov 1, 2023 · Assigned by redhat

CVE-2023-5178Kernel: use after free in nvmet_tcp_free_crypto in nvme

High 8.8

In plain English

A high-severity use-after-free in Red Hat Enterprise Linux 6 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 9.6% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)9.6%top 4.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Public PoC

Official description

A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	bpftool	4.18.0-513.9.1.el8_9	ALSA-2023:7549
AlmaLinux:8	kernel	4.18.0-513.9.1.el8_9	ALSA-2023:7549
AlmaLinux:8	kernel-abi-stablelists	4.18.0-513.9.1.el8_9	ALSA-2023:7549
AlmaLinux:8	kernel-core	4.18.0-513.9.1.el8_9	ALSA-2023:7549
AlmaLinux:8	kernel-cross-headers	4.18.0-513.9.1.el8_9	ALSA-2023:7549
AlmaLinux:8	kernel-debug	4.18.0-513.9.1.el8_9	ALSA-2023:7549
AlmaLinux:8	kernel-debug-core	4.18.0-513.9.1.el8_9	ALSA-2023:7549
AlmaLinux:8	kernel-debug-devel	4.18.0-513.9.1.el8_9	ALSA-2023:7549
AlmaLinux:8	kernel-debug-modules	4.18.0-513.9.1.el8_9	ALSA-2023:7549
AlmaLinux:8	kernel-debug-modules-extra	4.18.0-513.9.1.el8_9	ALSA-2023:7549
AlmaLinux:8	kernel-devel	4.18.0-513.9.1.el8_9	ALSA-2023:7549
AlmaLinux:8	kernel-doc	4.18.0-513.9.1.el8_9	ALSA-2023:7549
AlmaLinux:8	kernel-modules	4.18.0-513.9.1.el8_9	ALSA-2023:7549
AlmaLinux:8	kernel-modules-extra	4.18.0-513.9.1.el8_9	ALSA-2023:7549
AlmaLinux:8	kernel-tools	4.18.0-513.9.1.el8_9	ALSA-2023:7549
AlmaLinux:8	kernel-tools-libs	4.18.0-513.9.1.el8_9	ALSA-2023:7549
AlmaLinux:8	kernel-tools-libs-devel	4.18.0-513.9.1.el8_9	ALSA-2023:7549
AlmaLinux:8	kernel-zfcpdump	4.18.0-513.9.1.el8_9	ALSA-2023:7549
AlmaLinux:8	kernel-zfcpdump-core	4.18.0-513.9.1.el8_9	ALSA-2023:7549
AlmaLinux:8	kernel-zfcpdump-devel	4.18.0-513.9.1.el8_9	ALSA-2023:7549
AlmaLinux:8	kernel-zfcpdump-modules	4.18.0-513.9.1.el8_9	ALSA-2023:7549
AlmaLinux:8	kernel-zfcpdump-modules-extra	4.18.0-513.9.1.el8_9	ALSA-2023:7549
AlmaLinux:8	perf	4.18.0-513.9.1.el8_9	ALSA-2023:7549
AlmaLinux:8	python3-perf	4.18.0-513.9.1.el8_9	ALSA-2023:7549
Debian:12	linux	6.1.64-1	DEBIAN-CVE-2023-5178
Debian:13	linux	6.5.8-1	DEBIAN-CVE-2023-5178
Debian:14	linux	6.5.8-1	DEBIAN-CVE-2023-5178
Rocky Linux:8	kernel	0:4.18.0-513.9.1.el8_9	RLSA-2023:7549
Rocky Linux:8	kernel	0:4.18.0-513.9.1.el8_9.cloud	RXSA-2023:7549
Rocky Linux:8	kernel-rt	0:4.18.0-513.9.1.rt7.311.el8_9	RLSA-2023:7548
Ubuntu:22.04:LTS	linux	5.15.0-91.101	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux	5.15.0-91.101	USN-6549-1
Ubuntu:22.04:LTS	linux-allwinner-5.19	no fix listed	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-aws	5.15.0-1051.56	USN-6549-1
Ubuntu:22.04:LTS	linux-aws	5.15.0-1051.56	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-aws-5.19	no fix listed	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-aws-6.2	6.2.0-1017.17~22.04.1	USN-6534-1
Ubuntu:22.04:LTS	linux-aws-6.2	6.2.0-1017.17~22.04.1	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-aws-6.5	no fix listed	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-azure	5.15.0-1053.61	USN-6549-1
Ubuntu:22.04:LTS	linux-azure	5.15.0-1053.61	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-azure-5.19	no fix listed	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-azure-6.2	6.2.0-1018.18~22.04.1	USN-6534-1
Ubuntu:22.04:LTS	linux-azure-6.2	6.2.0-1018.18~22.04.1	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-azure-6.5	no fix listed	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-azure-fde	5.15.0-1053.61.1	USN-6549-1
Ubuntu:22.04:LTS	linux-azure-fde	5.15.0-1053.61.1	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-azure-fde-5.19	no fix listed	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-azure-fde-6.2	6.2.0-1018.18~22.04.1.1	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-azure-fde-6.2	6.2.0-1018.18~22.04.1.1	USN-6534-1
Ubuntu:22.04:LTS	linux-gcp	5.15.0-1048.56	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-gcp	5.15.0-1048.56	USN-6549-1
Ubuntu:22.04:LTS	linux-gcp-5.19	no fix listed	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-gcp-6.2	6.2.0-1021.23~22.04.1	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-gcp-6.2	6.2.0-1021.23~22.04.1	USN-6635-1
Ubuntu:22.04:LTS	linux-gke	5.15.0-1048.53	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-gke	5.15.0-1048.53	USN-6549-1
Ubuntu:22.04:LTS	linux-gkeop	5.15.0-1034.40	USN-6549-2
Ubuntu:22.04:LTS	linux-gkeop	5.15.0-1034.40	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-hwe-5.19	no fix listed	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-hwe-6.2	6.2.0-39.40~22.04.1	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-hwe-6.2	6.2.0-39.40~22.04.1	USN-6534-3
Ubuntu:22.04:LTS	linux-ibm	5.15.0-1044.47	USN-6549-1
Ubuntu:22.04:LTS	linux-ibm	5.15.0-1044.47	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-intel-iotg	5.15.0-1046.52	USN-6549-4
Ubuntu:22.04:LTS	linux-intel-iotg	5.15.0-1046.52	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-kvm	5.15.0-1048.53	USN-6549-1
Ubuntu:22.04:LTS	linux-kvm	5.15.0-1048.53	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-lowlatency	5.15.0-91.101	USN-6549-3
Ubuntu:22.04:LTS	linux-lowlatency	5.15.0-91.101	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-lowlatency-hwe-5.19	no fix listed	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-lowlatency-hwe-6.2	6.2.0-1018.18~22.04.1	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-lowlatency-hwe-6.2	6.2.0-1018.18~22.04.1	USN-6534-3
Ubuntu:22.04:LTS	linux-nvidia	5.15.0-1042.42	USN-6549-1
Ubuntu:22.04:LTS	linux-nvidia	5.15.0-1042.42	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-nvidia-6.2	6.2.0-1013.13	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-nvidia-6.2	6.2.0-1013.13	USN-6534-3
Ubuntu:22.04:LTS	linux-nvidia-6.5	6.5.0-1007.7	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-nvidia-tegra	5.15.0-1020.20	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-nvidia-tegra-igx	5.15.0-1007.7	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-oem-5.17	no fix listed	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-oem-6.0	no fix listed	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-oem-6.1	6.1.0-1026.26	USN-6497-1
Ubuntu:22.04:LTS	linux-oem-6.1	6.1.0-1026.26	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-oem-6.5	6.5.0-1009.10	USN-6536-1
Ubuntu:22.04:LTS	linux-oem-6.5	6.5.0-1009.10	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-oracle	5.15.0-1049.55	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-oracle	5.15.0-1049.55	USN-6549-1
Ubuntu:22.04:LTS	linux-raspi	5.15.0-1044.47	USN-6549-1
Ubuntu:22.04:LTS	linux-raspi	5.15.0-1044.47	UBUNTU-CVE-2023-5178
Ubuntu:24.04:LTS	linux-raspi-realtime	no fix listed	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-realtime	no fix listed	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-riscv	no fix listed	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-riscv-5.19	no fix listed	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-starfive-5.19	no fix listed	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-starfive-6.2	no fix listed	UBUNTU-CVE-2023-5178
Ubuntu:22.04:LTS	linux-xilinx-zynqmp	5.15.0-1027.31	UBUNTU-CVE-2023-5178

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.2 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.2 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	see references
Red Hat	Red Hat Virtualization 4 for Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 6	see references
Red Hat	Red Hat Enterprise Linux 7	see references
Red Hat	Red Hat Enterprise Linux 7	see references

Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

RHSA-2023:7370 vendor-advisory, x_refsource_REDHAT
RHSA-2023:7379 vendor-advisory, x_refsource_REDHAT
RHSA-2023:7418 vendor-advisory, x_refsource_REDHAT
RHSA-2023:7548 vendor-advisory, x_refsource_REDHAT
RHSA-2023:7549 vendor-advisory, x_refsource_REDHAT
RHSA-2023:7551 vendor-advisory, x_refsource_REDHAT
RHSA-2023:7554 vendor-advisory, x_refsource_REDHAT
RHSA-2023:7557 vendor-advisory, x_refsource_REDHAT
RHSA-2023:7559 vendor-advisory, x_refsource_REDHAT
RHSA-2024:0340 vendor-advisory, x_refsource_REDHAT
RHSA-2024:0378 vendor-advisory, x_refsource_REDHAT
RHSA-2024:0386 vendor-advisory, x_refsource_REDHAT
RHSA-2024:0412 vendor-advisory, x_refsource_REDHAT
RHSA-2024:0431 vendor-advisory, x_refsource_REDHAT
RHSA-2024:0432 vendor-advisory, x_refsource_REDHAT
RHSA-2024:0461 vendor-advisory, x_refsource_REDHAT
RHSA-2024:0554 vendor-advisory, x_refsource_REDHAT
RHSA-2024:0575 vendor-advisory, x_refsource_REDHAT
RHSA-2024:1268 vendor-advisory, x_refsource_REDHAT
RHSA-2024:1269 vendor-advisory, x_refsource_REDHAT
RHSA-2024:1278 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2023-5178 vdb-entry, x_refsource_REDHAT
RHBZ#2241924 issue-tracking, x_refsource_REDHAT
https://lore.kernel.org/linux-nvme/20231002105428.226515-1-sagi@grimberg.me/
https://lists.debian.org/debian-lts-announce/2024/01/msg00005.html x_transferred
https://security.netapp.com/advisory/ntap-20231208-0004/ x_transferred
https://cert-portal.siemens.com/productcert/html/ssa-794697.html
https://cert-portal.siemens.com/productcert/html/ssa-613116.html