diff mbox series

[v4,7/8] cve-exclusions: set status for CVE-2023-6238

Message ID 20260824042123.1456876-8-junjie.cao@linux.dev
State New
Headers show
Series cve-exclusions: triage eight kernel CVEs lacking upstream fix data | expand

Commit Message

Junjie Cao Aug. 24, 2026, 4:21 a.m. UTC 
NVME_IOCTL_IO_CMD and the io_uring passthrough path have never checked
the user-supplied metadata length against the number of blocks and the
namespace metadata size that the device uses to size the transfer, so
the device can DMA past the end of the buffer. 855b7717f44b ("nvme:
fine-granular CAP_SYS_ADMIN for nvme io commands", v6.2) let users with
write access to the device node issue the ioctl, turning the missing
check into an exposure; kernels before v6.2 are not affected, as Debian
concluded independently:

  https://security-tracker.debian.org/tracker/CVE-2023-6238

A fix removing unprivileged passthrough was proposed but not merged to
mainline, and nvme_map_user_request() still passes the metadata length
to blk_rq_integrity_map_user() with no cross-check:

  https://lore.kernel.org/linux-nvme/20231016060519.231880-1-joshi.k@samsung.com/

CC: Paul Barker <paul@pbarker.dev>
AI-Generated: Uses Claude (claude-opus-5)
Signed-off-by: Junjie Cao <junjie.cao@linux.dev>
---
v4:
- rework the explanation around 855b7717f44b making the ioctl reachable,
  per review; drop the applied-then-backed-out narrative
- status reads "Proposed fix was not merged" rather than "withdrawn",
  as flagged on the v3 thread: the fix was backed out by the nvme
  maintainer, not withdrawn by its author

v3: https://lore.kernel.org/openembedded-core/20260812072842.1176341-1-junjie.cao@linux.dev/

 meta/recipes-kernel/linux/cve-exclusion.inc | 10 ++++++++++
 1 file changed, 10 insertions(+)
diff mbox series

Patch

diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc
index a133bf08..4729191a 100644
--- a/meta/recipes-kernel/linux/cve-exclusion.inc
+++ b/meta/recipes-kernel/linux/cve-exclusion.inc
@@ -240,3 +240,13 @@  CVE_STATUS[CVE-2022-4543] = "unpatched: No fix has been proposed"
 # https://security-tracker.debian.org/tracker/CVE-2023-3397
 # https://ubuntu.com/security/CVE-2023-3397
 CVE_STATUS[CVE-2023-3397] = "unpatched: Proposed fix was withdrawn"
+
+# Triaged August 2026 - Issue was introduced by kernel commit 855b7717f44b
+# ("nvme: fine-granular CAP_SYS_ADMIN for nvme io commands") in Linux v6.2.
+# Linux 6.1 and earlier not affected. Unfixed in recent Debian/Ubuntu releases
+# which use affected kernels. There was a fix proposed, but it was not merged
+# to mainline.
+# https://security-tracker.debian.org/tracker/CVE-2023-6238
+# https://ubuntu.com/security/CVE-2023-6238
+# https://lore.kernel.org/linux-nvme/20231016060519.231880-1-joshi.k@samsung.com/
+CVE_STATUS[CVE-2023-6238] = "unpatched: Proposed fix was not merged"