In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()<\/p>\n
Two latent bugs in the Text-phase handler, both present since the
\noriginal LIO integration in commit e48354ce078c (“iscsi-target: Add
\niSCSI fabric support for target v4.1”):<\/p>\n
1) DataDigest CRC buffer overread (4 bytes past text_in).<\/p>\n
text_in is kzalloc()’d at ALIGN(payload_length, 4). rx_size is then
\n incremented by ISCSI_CRC_LEN to make room for the received DataDigest
\n in the iovec, but the same (now-bumped) rx_size is passed as the
\n buffer length to iscsit_crc_buf():<\/p>\n
if (conn->conn_ops->DataDigest) {
\n …
\n rx_size += ISCSI_CRC_LEN;
\n }
\n …
\n if (conn->conn_ops->DataDigest) {
\n data_crc = iscsit_crc_buf(text_in, rx_size, 0, NULL);<\/p>\n
iscsit_crc_buf() walks rx_size bytes of text_in with crc32c(), so
\n when DataDigest is negotiated it reads 4 bytes past the end of the
\n text_in allocation. KASAN reproduces this directly on the unpatched
\n mainline tree as slab-out-of-bounds in crc32c() called from the Text
\n PDU path. The OOB bytes feed crc32c() and are then compared against
\n the initiator-supplied checksum, so the value does not flow back to
\n the attacker, but the kernel does read past the buffer on every Text
\n PDU with DataDigest=CRC32C.<\/p>\n
Fix by passing the actual padded payload length
\n (ALIGN(payload_length, 4)) that was used for the kzalloc().<\/p>\n
2) Stale cmd->text_in_ptr re-free (double-free) on ERL>0 bad DataDigest
\n drop.<\/p>\n
On DataDigest mismatch with ErrorRecoveryLevel > 0 the handler
\n silently drops the PDU and lets the initiator plug the CmdSN gap:<\/p>\n
kfree(text_in);
\n return 0;<\/p>\n
cmd->text_in_ptr still points at the freed buffer. The next Text
\n Request on the same ITT re-enters iscsit_setup_text_cmd(), which
\n unconditionally does<\/p>\n
kfree(cmd->text_in_ptr);
\n cmd->text_in_ptr = NULL;<\/p>\n
freeing the same pointer a second time. Session teardown via
\n iscsit_release_cmd() has the same shape and hits the same double-free
\n if the connection is dropped before a second Text Request arrives.<\/p>\n
On an unmodified mainline tree the bug-1 CRC overread fires first on
\n the initial valid Text Request and perturbs the subsequent state, so
\n #4 was isolated by building a kernel with only the bug-1 hunk of this
\n patch applied plus temporary printk() observability around the three
\n relevant kfree() sites. The observability prints are not part of
\n this patch. On that build, a three-PDU Text Request sequence after
\n login produces two back-to-back splats:<\/p>\n
BUG: KASAN: double-free in iscsit_setup_text_cmd+0x??
\n BUG: KASAN: double-free in iscsit_release_cmd+0x??<\/p>\n
showing the same pointer freed in the ERL>0 drop path and again in
\n iscsit_setup_text_cmd() (next Text Request on the same ITT) and once
\n more in iscsit_release_cmd() (session teardown). On distro kernels
\n with CONFIG_SLAB_FREELIST_HARDENED=y (default) the double-free
\n becomes a remote kernel BUG(); on non-hardened kernels it corrupts
\n the slab freelist.<\/p>\n
Fix by clearing cmd->text_in_ptr after the kfree() in the ERL>0 drop
\n path. With both hunks applied #4 is directly observable on the stock
\n tree without observability printks; fixing bug-1 alone would mask #4
\n less, not more, so the hunks are submitted together.<\/p>\n
Both fixes are one-liners. The Text PDU state machine is unchanged and
\nthe wire protocol is unaffected.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()<\/p>\n
Two latent bugs in the Text-phase handler, both <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14942","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14942","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14942"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14942"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14942"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}