In the Linux kernel, the following vulnerability has been resolved:
scsi: libiscsi: Reject a negative task index from parse_pdu_itt
A transport that implements parse_pdu_itt hands libiscsi an index taken
from the PDU, and both lookups bound it from above only:
<pre>
if (i >= session->cmds_max)
</pre>
i and cmds_max are both int, so a negative index passes and
session->cmds[i] is read from before the array.
be2iscsi produces one. beiscsi_parse_pdu() assigns the raw tag,
<pre>
*index = (int)itt;
</pre>
and beiscsi_complete_pdu() forwards an unsolicited NOP-In from the
hardware async ring without replacing its ITT, so the value is the
target's. It also reports the session's own age rather than the one in
the tag, which leaves the age comparison in iscsi_verify_itt() with
nothing to reject.
Bound the index from below in both lookups.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - A target-supplied iSCSI NOP-In enters through be_isr_msix()/be_iopoll() and flows via beiscsi_process_cq() and beiscsi_complete_pdu() to patched iscsi_verify_itt()/iscsi_itt_to_task(); beiscsi_parse_pdu() derives the negative index directly from the wire ITT.
AC:L - On an affected be2iscsi connection, one NOP-In whose raw ITT casts negative deterministically passes the old upper-only checks. The sender chooses the ITT, and no race, timing window, or uncontrollable state is required.
PR:N - The remote iSCSI target needs no host privilege: beiscsi_complete_pdu() accepts the hardware-ring NOP-In and __iscsi_complete_pdu() calls iscsi_verify_itt() without a credential or session-state gate. CAP_SYS_ADMIN governs local netlink setup, not this receive path.
UI:N - The IRQ-poll path automatically processes the target's NOP-In through beiscsi_hdq_process_compl() and beiscsi_hdl_fwd_pdu(); no user must open a file, issue I/O, or approve the malformed PDU.
S:U - The invalid session->cmds lookup and subsequent iscsi_task and be2iscsi resource corruption occur within the initiator host kernel; no VM, IOMMU, or other security-authority boundary is crossed.
C:H - beiscsi_parse_pdu() supplies attacker-controlled signed i to iscsi_itt_to_task(), permitting a pointer-sized read at an attacker-selected offset before session->cmds. The loaded pointer is then dereferenced as an iscsi_task, making this an unbounded kernel-memory read and type-confusion primitive.
I:H - iscsi_pool_init() places its original task-pointer table immediately before session->cmds, so negative indices can select real unrelated tasks. iscsi_complete_task() then changes task state/refcounts and can invoke beiscsi_cleanup_task() to free live DMA, WRB, and SGL resources.
A:H - A farther-negative index can fault while reading session->cmds[i], while an index resolving to a never-used task reaches iscsi_nop_out_rsp() with task->conn NULL. A single target-supplied NOP-In can therefore oops or panic the kernel.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - A target-supplied iSCSI NOP-In enters through be_isr_msix()/be_iopoll() and flows via beiscsi_process_cq() and beiscsi_complete_pdu() to patched iscsi_verify_itt()/iscsi_itt_to_task(); beiscsi_parse_pdu() derives the negative index directly from the wire ITT.
AC:L - On an affected be2iscsi connection, one NOP-In whose raw ITT casts negative deterministically passes the old upper-only checks. The sender chooses the ITT, and no race, timing window, or uncontrollable state is required.
PR:N - The remote iSCSI target needs no host privilege: beiscsi_complete_pdu() accepts the hardware-ring NOP-In and __iscsi_complete_pdu() calls iscsi_verify_itt() without a credential or session-state gate. CAP_SYS_ADMIN governs local netlink setup, not this receive path.
UI:N - The IRQ-poll path automatically processes the target's NOP-In through beiscsi_hdq_process_compl() and beiscsi_hdl_fwd_pdu(); no user must open a file, issue I/O, or approve the malformed PDU.
S:U - The invalid session->cmds lookup and subsequent iscsi_task and be2iscsi resource corruption occur within the initiator host kernel; no VM, IOMMU, or other security-authority boundary is crossed.
C:H - beiscsi_parse_pdu() supplies attacker-controlled signed i to iscsi_itt_to_task(), permitting a pointer-sized read at an attacker-selected offset before session->cmds. The loaded pointer is then dereferenced as an iscsi_task, making this an unbounded kernel-memory read and type-confusion primitive.
I:H - iscsi_pool_init() places its original task-pointer table immediately before session->cmds, so negative indices can select real unrelated tasks. iscsi_complete_task() then changes task state/refcounts and can invoke beiscsi_cleanup_task() to free live DMA, WRB, and SGL resources.
A:H - A farther-negative index can fault while reading session->cmds[i], while an index resolving to a never-used task reaches iscsi_nop_out_rsp() with task->conn NULL. A single target-supplied NOP-In can therefore oops or panic the kernel.
CVSS 3.1