Linux Kernel NVMe over TCP Memory Corruption Vulnerability

A vulnerability in the Linux kernel's NVMe over TCP implementation could lead to memory corruption. The issue arises in the 'nvme_tcp_recv_pdu()' function, which fails to validate the header length. When header digests are enabled, a target may send a packet with an invalid header length, causing the 'nvme_tcp_verify_hdgst()' function to access memory outside the allocated bounds. This can overwrite memory with the calculated digest, leading to corruption. The vulnerability has been addressed by rejecting packets with unexpected header lengths.

Impact

Exploitation of this vulnerability could result in memory corruption, allowing for potential arbitrary code execution or causing a denial-of-service condition.