Vulnerability-Lookup

GHSA-RW6F-QWRG-VHVV

Vulnerability from github – Published: 2024-11-21 21:33 – Updated: 2025-11-04 00:32

Details

In the Linux kernel, the following vulnerability has been resolved:

nvme-multipath: defer partition scanning

We need to suppress the partition scan from occuring within the controller's scan_work context. If a path error occurs here, the IO will wait until a path becomes available or all paths are torn down, but that action also occurs within scan_work, so it would deadlock. Defer the partion scan to a different context that does not block scan_work.

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-53093"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-21T19:15:12Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-multipath: defer partition scanning\n\nWe need to suppress the partition scan from occuring within the\ncontroller\u0027s scan_work context. If a path error occurs here, the IO will\nwait until a path becomes available or all paths are torn down, but that\naction also occurs within scan_work, so it would deadlock. Defer the\npartion scan to a different context that does not block scan_work.",
  "id": "GHSA-rw6f-qwrg-vhvv",
  "modified": "2025-11-04T00:32:06Z",
  "published": "2024-11-21T21:33:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53093"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1f021341eef41e77a633186e9be5223de2ce5d48"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4a57f42e5ed42cb8f1beb262c4f6d3e698939e4e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/60de2e03f984cfbcdc12fa552f95087c35a05a98"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a91b7eddf45afeeb9c5ece11dddff5de0921b00f"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2024-53093 (GCVE-0-2024-53093)

Vulnerability from cvelistv5 – Published: 2024-11-21 18:17 – Updated: 2026-08-05 11:43

Title

nvme-multipath: defer partition scanning

Summary

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: defer partition scanning We need to suppress the partition scan from occuring within the controller's scan_work context. If a path error occurs here, the IO will wait until a path becomes available or all paths are torn down, but that action also occurs within scan_work, so it would deadlock. Defer the partion scan to a different context that does not block scan_work.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-10-01 20:11 UTC

CWE

CWE-noinfo Not enough information

Assigner

Linux CNA under the mitre root

CNA scorecard D 54/100 over 6633 records in the last 180 days details

References

5 references

URL	Tags
https://git.kernel.org/stable/c/60de2e03f984cfbcd…
https://git.kernel.org/stable/c/4a57f42e5ed42cb8f…
https://git.kernel.org/stable/c/a91b7eddf45afeeb9…
https://git.kernel.org/stable/c/1f021341eef41e77a…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 32acab3181c7053c775ca128c3a5c6ce50197d7f , < 60de2e03f984cfbcdc12fa552f95087c35a05a98 (git) Affected: 32acab3181c7053c775ca128c3a5c6ce50197d7f , < 4a57f42e5ed42cb8f1beb262c4f6d3e698939e4e (git) Affected: 32acab3181c7053c775ca128c3a5c6ce50197d7f , < a91b7eddf45afeeb9c5ece11dddff5de0921b00f (git) Affected: 32acab3181c7053c775ca128c3a5c6ce50197d7f , < 1f021341eef41e77a633186e9be5223de2ce5d48 (git)
Linux	Linux	Affected: 4.15 Unaffected: 0 , < 4.15 (semver) Unaffected: 6.1.118 , ≤ 6.1.* (semver) Unaffected: 6.6.62 , ≤ 6.6.* (semver) Unaffected: 6.11.9 , ≤ 6.11.* (semver) Unaffected: 6.12 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-53093",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:11:24.276538Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:17:13.381Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:29:08.209Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/host/multipath.c",
            "drivers/nvme/host/nvme.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "60de2e03f984cfbcdc12fa552f95087c35a05a98",
              "status": "affected",
              "version": "32acab3181c7053c775ca128c3a5c6ce50197d7f",
              "versionType": "git"
            },
            {
              "lessThan": "4a57f42e5ed42cb8f1beb262c4f6d3e698939e4e",
              "status": "affected",
              "version": "32acab3181c7053c775ca128c3a5c6ce50197d7f",
              "versionType": "git"
            },
            {
              "lessThan": "a91b7eddf45afeeb9c5ece11dddff5de0921b00f",
              "status": "affected",
              "version": "32acab3181c7053c775ca128c3a5c6ce50197d7f",
              "versionType": "git"
            },
            {
              "lessThan": "1f021341eef41e77a633186e9be5223de2ce5d48",
              "status": "affected",
              "version": "32acab3181c7053c775ca128c3a5c6ce50197d7f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/host/multipath.c",
            "drivers/nvme/host/nvme.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.118",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.62",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.118",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.62",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.9",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-multipath: defer partition scanning\n\nWe need to suppress the partition scan from occuring within the\ncontroller\u0027s scan_work context. If a path error occurs here, the IO will\nwait until a path becomes available or all paths are torn down, but that\naction also occurs within scan_work, so it would deadlock. Defer the\npartion scan to a different context that does not block scan_work."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - NVMe multipath heads exist for all NVMe-over-Fabrics subsystems, and a remote NVMe/TCP target reaches this code over a routable TCP connection by sending a Namespace-Changed AEN and then inducing a path error. The entire trigger sequence is delivered as protocol data from a remote peer.\nAC:L - The attacker controls both halves of the condition \u2014 it decides when scan_work runs (NS_CHANGED AEN) and when the path fails (connection drop, error completion, or ANA inaccessible state), so the deadlock window is created rather than waited for. No memory layout or victim state outside attacker influence is needed.\nPR:N - NVMe/TCP has no mandatory authentication or transport security, so a malicious, compromised, or spoofed target needs no credentials on the victim host. The AEN and error-injection path requires no login to the host system at all.\nUI:N - The host connection is a pre-existing configuration state, not an action taken per-attack; the target drives the AEN and path failure asynchronously with no local user involvement.\nS:U - The deadlock is confined to the kernel\u0027s own storage stack within the same security authority \u2014 no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The flaw is a blocking-context deadlock with no out-of-bounds access, freed-object reuse, or uninitialized data exposure, so no information is disclosed.\nI:N - No memory is corrupted and no data is modified; the partition-scan I/O is requeued intact rather than being mis-executed or written incorrectly.\nA:H - scan_work deadlocks permanently while holding ctrl-\u003escan_lock, and every recovery path (nvme_stop_ctrl reset, nvme_remove_namespaces delete/disconnect) does flush_work(\u0026ctrl-\u003escan_work) and hangs too, producing unkillable D-state tasks, hung-task panics, and a permanently inaccessible storage subsystem requiring a reboot."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:43:36.925Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/60de2e03f984cfbcdc12fa552f95087c35a05a98"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a57f42e5ed42cb8f1beb262c4f6d3e698939e4e"
        },
        {
          "url": "https://git.kernel.org/stable/c/a91b7eddf45afeeb9c5ece11dddff5de0921b00f"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f021341eef41e77a633186e9be5223de2ce5d48"
        }
      ],
      "title": "nvme-multipath: defer partition scanning",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-53093",
    "datePublished": "2024-11-21T18:17:09.807Z",
    "dateReserved": "2024-11-19T17:17:24.982Z",
    "dateUpdated": "2026-08-05T11:43:36.925Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-RW6F-QWRG-VHVV

CVE-2024-53093 (GCVE-0-2024-53093)

Tags

Sightings

Nomenclature

Related by attack behaviour