Security readout for executives and security teams
Plain-English summary
CVE-2023-6121 is a Linux kernel information leak in the NVMe over Fabrics TCP subsystem. A crafted network packet can cause kernel heap data to be printed into dmesg. Business risk is usually moderate, but higher where storage services are exposed across untrusted networks.
Executive priority
Treat as scheduled but meaningful kernel remediation. Escalate priority for storage infrastructure exposed beyond tightly controlled networks, because kernel memory disclosure can aid later compromise even when this CVE alone is not high severity.
Technical view
The flaw is an out-of-bounds read in nvmet_ctrl_find_get, classified as CWE-125. Red Hat rates it CVSS 4.3: network attack vector, low complexity, low privileges, no user interaction, and low confidentiality impact. The provided data lists affected Red Hat kernel and kernel-rt packages for RHEL 8 and RHEL 9.
Likely exposure
Exposure is most likely on Linux systems using NVMe-oF/TCP target functionality. The bundle specifically names affected Red Hat Enterprise Linux 8 and 9 kernel packages. RHEL 6 and 7 status is listed as unknown, so those require vendor verification.
Exploitation context
The source bundle does not show CISA KEV listing or other evidence of active exploitation. The described attack is remote over the network but requires low privileges. The observed impact is leakage of kmalloc data into the kernel ring buffer, not direct code execution.
Researcher notes
Evidence is strongest for Red Hat advisories and the CVE description. The bundle references Debian LTS and Siemens advisories, but affected product details are not included here. Do not assume exploitation in the wild or broader product impact without checking those advisories.
Mitigation direction
- Apply the relevant Red Hat kernel errata for affected RHEL 8 and 9 systems.
- Check Debian and Siemens advisories for product-specific update guidance.
- Reduce NVMe-oF/TCP exposure to only trusted management or storage networks.
- Prioritize patching systems where untrusted users can reach NVMe-oF/TCP.
- Reboot into the updated kernel when the vendor update requires it.
Validation and detection
- Inventory Linux hosts using NVMe-oF/TCP target functionality.
- Compare installed kernel and kernel-rt versions against vendor advisory status.
- Confirm RHEL 6 and 7 exposure directly with vendor guidance because status is unknown.
- Review kernel logs for suspicious NVMe-oF/TCP-related leakage indicators.
- Verify patched systems are running the updated kernel, not only installed packages.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-6121 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N2.81.4redhatVulnerability scoring details
Base CVSS 3.1 score
4.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineredhat
Made public.
- Source timelineredhat
Reported to Red Hat.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2024:2394CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:2950CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:3138CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2023-6121CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2250043CVE reference, redhat · issue-tracking, x_refsource_REDHAT
- https://lists.debian.org/debian-lts-announce/2024/01/msg00005.htmlCVE reference, CVE · x_transferred
- https://cert-portal.siemens.com/productcert/html/ssa-398330.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-613116.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.