In the Linux kernel, the following vulnerability has been resolved:
scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
core_scsi3_emulate_pro_register_and_move() maps the PERSISTENT RESERVE OUT
parameter list with transport_kmap_data_sg() and parses the destination
TransportID with target_parse_pr_out_transport_id(). For an iSCSI
TransportID (FORMAT CODE 01b), iscsi_parse_pr_out_transport_id() returns
the ISID in iport_ptr as a raw pointer into that mapped buffer.
The function then unmaps the buffer with transport_kunmap_data_sg() before
dereferencing iport_ptr in strcmp(), __core_scsi3_locate_pr_reg() and
core_scsi3_alloc_registration(). When the parameter list spans more than
one page (PARAMETER LIST LENGTH > 4096), transport_kmap_data_sg() uses
vmap() and transport_kunmap_data_sg() does vunmap(), so the kernel virtual
address backing iport_ptr is torn down and every subsequent dereference is
a use-after-free read of the unmapped region.
Keep the parameter list mapped until iport_ptr is no longer needed: drop
the early transport_kunmap_data_sg() and unmap once on the success path,
right before returning. The error paths already unmap through the existing
"if (buf) transport_kunmap_data_sg(cmd)" at the out: label, which now runs
on every post-map error exit because buf is no longer cleared early. Only
reads of the mapping happen while spinlocks are held; the map and unmap
calls remain outside any lock. The sibling caller
core_scsi3_decode_spec_i_port() already uses the buffer before unmapping it
and is left unchanged.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - On LIO/iSCSI storage servers and appliances, a remote initiator sends PERSISTENT_RESERVE_OUT with REGISTER AND MOVE over TCP (port 3260); iscsit_process_scsi_cmd()→target_execute_cmd()→target_scsi3_emulate_pr_out()→core_scsi3_emulate_pro_register_and_move() with no local access required.
AC:L - The attacker fully controls the PR-OUT parameter list length (>4096 to force vmap/vunmap), iSCSI TransportID format 01b with ISID, and can establish prerequisite PR registration and reservation via prior SCSI commands on the same session; no uncontrollable race or layout dependency exists.
PR:N - Exploitation requires only the ability to act as a network SCSI/iSCSI client with LUN access to an exported target; no Linux UID, capability, or init-namespace root on the storage server is needed—only standard iSCSI initiator connectivity (CHAP/ACL when configured).
UI:N - Triggering is fully automated once an iSCSI session exists: the attacker issues scripted REGISTER, RESERVE, then REGISTER AND MOVE commands with a crafted >4 KiB parameter list; no victim mount, click, or other interactive action is required.
S:U - The UAF corrupts kernel heap state inside the target-core PR handler on the storage host; impact stays within that kernel security domain and does not inherently cross VM, container, or IOMMU boundaries (standard host compromise, not escape).
C:H - After vunmap(), iport_ptr aliases freed kernel virtual address space and is dereferenced in strcmp(), __core_scsi3_locate_pr_reg(), and snprintf() into pr_reg_isid; per kernel CVSS guidance, UAF reads enable arbitrary kernel memory disclosure when uncertain.
I:H - UAF reads of attacker-influenced unmapped PR-OUT data drive strcmp-based registration matching and snprintf copies into persistent kernel pr_reg structures; memory corruption/UAF is scored High for integrity because it can be leveraged for control-flow or state manipulation.
A:H - Dereferencing iport_ptr after transport_kunmap_data_sg() vunmap() on multi-page buffers causes immediate invalid kernel virtual address accesses (oops/panic) on every qualifying REGISTER AND MOVE; UAF availability impact is High per kernel guidance even before full exploit development.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - On LIO/iSCSI storage servers and appliances, a remote initiator sends PERSISTENT_RESERVE_OUT with REGISTER AND MOVE over TCP (port 3260); iscsit_process_scsi_cmd()→target_execute_cmd()→target_scsi3_emulate_pr_out()→core_scsi3_emulate_pro_register_and_move() with no local access required.
AC:L - The attacker fully controls the PR-OUT parameter list length (>4096 to force vmap/vunmap), iSCSI TransportID format 01b with ISID, and can establish prerequisite PR registration and reservation via prior SCSI commands on the same session; no uncontrollable race or layout dependency exists.
PR:N - Exploitation requires only the ability to act as a network SCSI/iSCSI client with LUN access to an exported target; no Linux UID, capability, or init-namespace root on the storage server is needed—only standard iSCSI initiator connectivity (CHAP/ACL when configured).
UI:N - Triggering is fully automated once an iSCSI session exists: the attacker issues scripted REGISTER, RESERVE, then REGISTER AND MOVE commands with a crafted >4 KiB parameter list; no victim mount, click, or other interactive action is required.
S:U - The UAF corrupts kernel heap state inside the target-core PR handler on the storage host; impact stays within that kernel security domain and does not inherently cross VM, container, or IOMMU boundaries (standard host compromise, not escape).
C:H - After vunmap(), iport_ptr aliases freed kernel virtual address space and is dereferenced in strcmp(), __core_scsi3_locate_pr_reg(), and snprintf() into pr_reg_isid; per kernel CVSS guidance, UAF reads enable arbitrary kernel memory disclosure when uncertain.
I:H - UAF reads of attacker-influenced unmapped PR-OUT data drive strcmp-based registration matching and snprintf copies into persistent kernel pr_reg structures; memory corruption/UAF is scored High for integrity because it can be leveraged for control-flow or state manipulation.
A:H - Dereferencing iport_ptr after transport_kunmap_data_sg() vunmap() on multi-page buffers causes immediate invalid kernel virtual address accesses (oops/panic) on every qualifying REGISTER AND MOVE; UAF availability impact is High per kernel guidance even before full exploit development.
CVSS 3.1