Storage Performance Development Kit Buffer Overflow Vulnerability in NVMe-oF Target Component

A buffer overflow vulnerability has been identified in the Storage Performance Development Kit (SPDK) version 25.05, specifically within the NVMe-over-Fabrics (NVMe-oF) target component. The issue arises in the 'lib/nvmf' library, where an array-out-of-bounds access can occur during the update of registrants for a namespace with the 'Persist through power loss' (PTPL) feature enabled. This vulnerability allows memory beyond the array's boundary to be overwritten with data from the Reservation Register command, potentially leading to arbitrary code execution. The vulnerability affects NVMe-oF transports over TCP and RDMA.

Impact

Exploitation of this vulnerability could lead to a buffer overflow, allowing for memory corruption and potentially arbitrary code execution.

Remediation

Users can upgrade to SPDK versions 25.09 or 25.05.1 to address this vulnerability.