In the Linux kernel, the following vulnerability has been resolved:
scsi: target: iscsi: Reserve a terminator byte for the login payload
iscsi_target_check_login_request() rejects a login PDU whose
DataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test is '>' and
login->req_buf is allocated with exactly MAX_KEY_VALUE_PAIRS
bytes. Since iscsit_get_login_rx() receives payload_length + padding
bytes, where
<pre>
padding = ((-payload_length) & 3);
</pre>
any payload_length from 8189 to 8192 fills the whole 8192 byte
buffer. The write stays in bounds, but no byte is left for a NUL
terminator.
The buffer is subsequently consumed as a C string. In the CHAP path
chap_check_algorithm() calls kstrdup(a_str), and extract_param() calls
strstr(in_buf, pattern) followed by strlen_semi(), none of which take a
length. convert_null_to_semi() additionally rewrites every embedded NUL
to ';', so even a payload made of well formed NUL separated key=value
records is left without a terminator. These walk past the end of the
object into adjacent slab memory. It is reachable by an unauthenticated
initiator against a portal configured for CHAP; when authentication is
not required iscsi_login_zero_tsih_s2() rewrites AuthMethod to None and
the CHAP path is never entered.
Allocate one extra byte. kzalloc() zeroes it and nothing ever writes to
it, as every writer copies to offset 0 for at most MAX_KEY_VALUE_PAIRS
bytes, so the buffer is always terminated.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS Score: 9.1
AV:N - The LIO in-kernel iSCSI target accepts remote TCP connections on the iSCSI portal (typically port 3260); a crafted Login PDU is received by iscsit_accept_np()/iscsit_get_login_rx() and reaches the CHAP parsers over the network, the same exposure model as nfsd or ksmbd.
AC:L - The attacker fully controls DataSegmentLength and the login payload. A CHAP_A PDU of 8189-8192 bytes with no NUL, or a second CHAP round where convert_null_to_semi() strips every terminator, makes kstrdup()/strstr() over-read adjacent slab deterministically; no race or victim-side layout is required.
PR:N - The over-read runs in the CHAP login handshake before the password hash is checked, so no Linux account or capability is needed. Default TPG authentication is CHAP (TA_AUTHENTICATION=1), and chap_server_open() proceeds once target-side CHAP credentials exist, which is the normal CHAP deployment.
UI:N - The attacker opens a TCP connection to the listening portal and sends the malicious Login PDUs; no victim user action such as mounting a volume or accepting a prompt is required.
S:U - The unbounded C-string over-read and any resulting kernel oops stay inside the host iSCSI target's kernel security authority and do not by themselves cross a VM, IOMMU, or sandbox boundary.
C:H - chap_check_algorithm() kstrdup()s the unterminated 8192-byte req_buf, and extract_param() uses unbounded strstr()/strlen_semi() after convert_null_to_semi() removes embedded NULs, producing an unbounded out-of-bounds read of adjacent kmalloc-8k slab that can disclose neighboring kernel objects.
I:N - iscsit_get_login_rx() copies at most MAX_KEY_VALUE_PAIRS bytes into req_buf, so the network write stays in bounds; convert_null_to_semi() also writes only within payload_length. There is no out-of-bounds write or control-flow hijack primitive.
A:H - strlen()/kstrdup()/strstr() walking past the kmalloc-8k login object into unmapped or guard pages causes a kernel oops, and the attacker can repeat the unauthenticated login against an exposed portal, denying service to the host and its iSCSI clients.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
None |
| User Interaction |
None |
Availability Impact |
High |
AV:N - The LIO in-kernel iSCSI target accepts remote TCP connections on the iSCSI portal (typically port 3260); a crafted Login PDU is received by iscsit_accept_np()/iscsit_get_login_rx() and reaches the CHAP parsers over the network, the same exposure model as nfsd or ksmbd.
AC:L - The attacker fully controls DataSegmentLength and the login payload. A CHAP_A PDU of 8189-8192 bytes with no NUL, or a second CHAP round where convert_null_to_semi() strips every terminator, makes kstrdup()/strstr() over-read adjacent slab deterministically; no race or victim-side layout is required.
PR:N - The over-read runs in the CHAP login handshake before the password hash is checked, so no Linux account or capability is needed. Default TPG authentication is CHAP (TA_AUTHENTICATION=1), and chap_server_open() proceeds once target-side CHAP credentials exist, which is the normal CHAP deployment.
UI:N - The attacker opens a TCP connection to the listening portal and sends the malicious Login PDUs; no victim user action such as mounting a volume or accepting a prompt is required.
S:U - The unbounded C-string over-read and any resulting kernel oops stay inside the host iSCSI target's kernel security authority and do not by themselves cross a VM, IOMMU, or sandbox boundary.
C:H - chap_check_algorithm() kstrdup()s the unterminated 8192-byte req_buf, and extract_param() uses unbounded strstr()/strlen_semi() after convert_null_to_semi() removes embedded NULs, producing an unbounded out-of-bounds read of adjacent kmalloc-8k slab that can disclose neighboring kernel objects.
I:N - iscsit_get_login_rx() copies at most MAX_KEY_VALUE_PAIRS bytes into req_buf, so the network write stays in bounds; convert_null_to_semi() also writes only within payload_length. There is no out-of-bounds write or control-flow hijack primitive.
A:H - strlen()/kstrdup()/strstr() walking past the kmalloc-8k login object into unmapped or guard pages causes a kernel oops, and the attacker can repeat the unauthenticated login against an exposed portal, denying service to the host and its iSCSI clients.
CVSS 3.1