In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: libiscsi_tcp: Check the data direction of a Data-In PDU<\/p>\n
The Data-In branch of iscsi_tcp_hdr_dissect() resolves the ITT to a task
\nand copies the PDU’s data segment into that command’s scatterlist without
\nasking whether the command was reading. iscsi_tcp_r2t_rsp() in the same
\nfile does ask, and rejects an R2T for a command that is not DMA_TO_DEVICE.<\/p>\n
A target that answers a WRITE command’s ITT with a Data-In therefore has
\nthe initiator write target-supplied bytes into the pages that write was
\nabout to send. Those are the caller’s own pinned pages for an O_DIRECT
\nwrite, and page cache pages for a buffered one.<\/p>\n
Observed against a test target that emits one 512-byte Data-In naming a 128
\nKB write’s ITT, after the R2T for that write. With O_DIRECT the caller’s
\nbuffer ends up holding 512 bytes of the target’s data while pwrite()
\nreturns 131072. Buffered is quieter: pwrite() and fsync() both succeed,
\nnothing is logged, and reading those blocks back returns the target’s bytes
\nout of the page cache without a command going on the wire.<\/p>\n
Check the direction before using the scatterlist, the way the R2T path
\nalready does.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: libiscsi_tcp: Check the data direction of a Data-In PDU<\/p>\n
The Data-In branch of iscsi_tcp_hdr_dissect() resolves the ITT to a <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-40951","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/40951","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=40951"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=40951"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=40951"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}