CVE-2024-41079 — nvmet: always initialize cqe.result
In the Linux kernel, the following vulnerability has been resolved: nvmet: always initialize cqe.result The spec doesn't mandate that the first two double words (aka results) …
Published: 2024-07-29 · CVSS: 7.5 · CVSS 3.1
In the Linux kernel, the following vulnerability has been resolved: nvmet: always initialize cqe.result The spec doesn't mandate that the first two double words (aka results) for the command queue entry need to be set to 0 when they are not used (not specified). Though, the target implemention returns 0 for TCP and FC but not for RDMA. Let's make RDMA behave the same and thus explicitly initializing the result field. This prevents leaking any data from the stack.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7