{"id":14940,"date":"2026-09-04T19:02:19","date_gmt":"2026-09-04T11:02:19","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-63886"},"modified":"2026-09-04T19:02:19","modified_gmt":"2026-09-04T11:02:19","slug":"cve-2026-63886","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-63886","title":{"rendered":"CVE-2026-63886 [CRITICAL] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi:"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>scsi: target: iscsi: Validate CHAP_R length before base64 decode<\/p>\n<p>chap_server_compute_hash() allocates client_digest as<br \/>\nkzalloc(chap-&gt;digest_size) and then, for BASE64-encoded responses,<br \/>\npasses chap_r directly to chap_base64_decode() without checking whether<br \/>\nthe input length could produce more than digest_size bytes of output.<\/p>\n<p>chap_base64_decode() writes to the destination unconditionally as long<br \/>\nas there is input to consume. With MAX_RESPONSE_LENGTH set to 128 and<br \/>\nthe &#8220;0b&#8221; prefix stripped by extract_param(), up to 127 base64 characters<br \/>\ncan reach the decoder. 127 characters decode to 95 bytes. For SHA-256<br \/>\n(digest_size=32) this overflows client_digest by 63 bytes; for MD5<br \/>\n(digest_size=16) the overflow is 79 bytes.<\/p>\n<p>The length check at line 344 fires after the write has already happened.<\/p>\n<p>The HEX branch in the same switch statement already validates the length<br \/>\nup front. Apply the same approach to the BASE64 branch: strip trailing<br \/>\nbase64 padding characters, then reject any input whose data length<br \/>\nexceeds DIV_ROUND_UP(digest_size * 4, 3) before calling the decoder.<\/p>\n<p>Stripping trailing &#8216;=&#8217; before the comparison handles both padded and<br \/>\nunpadded encodings. chap_base64_decode() already returns early on &#8216;=&#8217;,<br \/>\nso the full original string is still passed to the decoder unchanged.<\/p>\n<p>The mutual CHAP path decodes CHAP_C into initiatorchg_binhex, which is<br \/>\nkzalloc(CHAP_CHALLENGE_STR_LEN). extract_param() caps initiatorchg at<br \/>\nCHAP_CHALLENGE_STR_LEN characters, so at most CHAP_CHALLENGE_STR_LEN-1<br \/>\nbase64 characters reach the decoder. The maximum decoded size,<br \/>\nDIV_ROUND_UP((CHAP_CHALLENGE_STR_LEN-1) * 3, 4), is less than<br \/>\nCHAP_CHALLENGE_STR_LEN, so no overflow is possible there. A comment is<br \/>\nadded at the call site to document this.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>scsi: target: iscsi: Validate CHAP_R length before base64 decode<\/p>\n<p>chap_server_compute_hash() allocates client_digest as<br \/>\nkzalloc(cha<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14940","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14940","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14940"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14940"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14940"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}