{"id":"CVE-2021-47290","state":"PUBLISHED","title":"scsi: target: Fix NULL dereference on XCOPY completion","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: Fix NULL dereference on XCOPY completion\n\nCPU affinity control added with commit 39ae3edda325 (\"scsi: target: core:\nMake completion affinity configurable\") makes target_complete_cmd() queue\nwork on a CPU based on se_tpg->se_tpg_wwn->cmd_compl_affinity state.\n\nLIO's EXTENDED COPY worker is a special case in that read/write cmds are\ndispatched using the global xcopy_pt_tpg, which carries a NULL se_tpg_wwn\npointer following initialization in target_xcopy_setup_pt().\n\nThe NULL xcopy_pt_tpg->se_tpg_wwn pointer is dereferenced on completion of\nany EXTENDED COPY initiated read/write cmds. E.g using the libiscsi\nSCSI.ExtendedCopy.Simple test:\n\n  BUG: kernel NULL pointer dereference, address: 00000000000001a8\n  RIP: 0010:target_complete_cmd+0x9d/0x130 [target_core_mod]\n  Call Trace:\n   fd_execute_rw+0x148/0x42a [target_core_file]\n   ? __dynamic_pr_debug+0xa7/0xe0\n   ? target_check_reservation+0x5b/0x940 [target_core_mod]\n   __target_execute_cmd+0x1e/0x90 [target_core_mod]\n   transport_generic_new_cmd+0x17c/0x330 [target_core_mod]\n   target_xcopy_issue_pt_cmd+0x9/0x60 [target_core_mod]\n   target_xcopy_read_source.isra.7+0x10b/0x1b0 [target_core_mod]\n   ? target_check_fua+0x40/0x40 [target_core_mod]\n   ? transport_complete_task_attr+0x130/0x130 [target_core_mod]\n   target_xcopy_do_work+0x61f/0xc00 [target_core_mod]\n\nThis fix makes target_complete_cmd() queue work on se_cmd->cpuid if\nse_tpg_wwn is NULL.","publishedAt":"2024-05-21T14:35:15.411Z","updatedAt":"2026-08-05T08:47:06.047Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"39ae3edda325e9cf9e978c9788affe88231f3b34","status":"affected","lessThan":"e7732c5a19a15a62b0b23fd683a639b0483e1f40","versionType":"git"},{"version":"39ae3edda325e9cf9e978c9788affe88231f3b34","status":"affected","lessThan":"a47fa41381a09e5997afd762664db4f5f6657e03","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/target/target_core_transport.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.13","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.13","versionType":"semver"},{"version":"5.13.6","status":"unaffected","lessThanOrEqual":"5.13.*","versionType":"semver"},{"version":"5.14","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/target/target_core_transport.c"]}],"references":["https://git.kernel.org/stable/c/e7732c5a19a15a62b0b23fd683a639b0483e1f40","https://git.kernel.org/stable/c/a47fa41381a09e5997afd762664db4f5f6657e03"],"weaknesses":[],"ingestedAt":"2026-10-29T19:49:19.404Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/47xxx/CVE-2021-47290.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2021-47290","state":"PUBLISHED","datePublished":"2024-05-21T14:35:15.411Z","dateUpdated":"2026-08-05T08:47:06.047Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-05-21T13:27:52.129Z"},"containers":{"cna":{"title":"scsi: target: Fix NULL dereference on XCOPY completion","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: Fix NULL dereference on XCOPY completion\n\nCPU affinity control added with commit 39ae3edda325 (\"scsi: target: core:\nMake completion affinity configurable\") makes target_complete_cmd() queue\nwork on a CPU based on se_tpg->se_tpg_wwn->cmd_compl_affinity state.\n\nLIO's EXTENDED COPY worker is a special case in that read/write cmds are\ndispatched using the global xcopy_pt_tpg, which carries a NULL se_tpg_wwn\npointer following initialization in target_xcopy_setup_pt().\n\nThe NULL xcopy_pt_tpg->se_tpg_wwn pointer is dereferenced on completion of\nany EXTENDED COPY initiated read/write cmds. E.g using the libiscsi\nSCSI.ExtendedCopy.Simple test:\n\n  BUG: kernel NULL pointer dereference, address: 00000000000001a8\n  RIP: 0010:target_complete_cmd+0x9d/0x130 [target_core_mod]\n  Call Trace:\n   fd_execute_rw+0x148/0x42a [target_core_file]\n   ? __dynamic_pr_debug+0xa7/0xe0\n   ? target_check_reservation+0x5b/0x940 [target_core_mod]\n   __target_execute_cmd+0x1e/0x90 [target_core_mod]\n   transport_generic_new_cmd+0x17c/0x330 [target_core_mod]\n   target_xcopy_issue_pt_cmd+0x9/0x60 [target_core_mod]\n   target_xcopy_read_source.isra.7+0x10b/0x1b0 [target_core_mod]\n   ? target_check_fua+0x40/0x40 [target_core_mod]\n   ? transport_complete_task_attr+0x130/0x130 [target_core_mod]\n   target_xcopy_do_work+0x61f/0xc00 [target_core_mod]\n\nThis fix makes target_complete_cmd() queue work on se_cmd->cpuid if\nse_tpg_wwn is NULL."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"39ae3edda325e9cf9e978c9788affe88231f3b34","status":"affected","lessThan":"e7732c5a19a15a62b0b23fd683a639b0483e1f40","versionType":"git"},{"version":"39ae3edda325e9cf9e978c9788affe88231f3b34","status":"affected","lessThan":"a47fa41381a09e5997afd762664db4f5f6657e03","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/target/target_core_transport.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.13","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.13","versionType":"semver"},{"version":"5.13.6","status":"unaffected","lessThanOrEqual":"5.13.*","versionType":"semver"},{"version":"5.14","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/target/target_core_transport.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/e7732c5a19a15a62b0b23fd683a639b0483e1f40"},{"url":"https://git.kernel.org/stable/c/a47fa41381a09e5997afd762664db4f5f6657e03"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - A remote SCSI initiator can trigger the bug over network fabrics such as LIO iSCSI/iSER by sending EXTENDED_COPY, which builds passthrough READ/WRITE cmds that complete through target_complete_cmd().\nAC:L - Any successful EXTENDED_COPY that performs read/write I/O hits the NULL se_tpg_wwn dereference on completion; emulate_3pc is enabled by default and no race or external timing is required.\nPR:N - Although CHAP can be enforced, a reasonable exposed LIO target may disable authentication or use open initiator ACLs, so an unauthenticated remote initiator with LUN access is a plausible highest-severity scenario.\nUI:N - No victim user action is required after the target is exported; the attacker sends the SCSI EXTENDED_COPY command directly.\nS:U - Impact remains within the host kernel SCSI target security authority; this is a DoS of the target host itself, not a guest-to-host or other scope-crossing escape.\nC:N - The defect is a pure NULL pointer dereference of se_tpg_wwn when selecting completion CPU affinity and does not leak kernel or storage data.\nI:N - The NULL dereference performs no write or control-flow hijack beyond the crash; there is no memory corruption primitive.\nA:H - The NULL dereference produces a kernel oops/BUG as shown in the fix commit, which can crash or destabilize the target host."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T08:47:06.047Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"5.13.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"5.14"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/e7732c5a19a15a62b0b23fd683a639b0483e1f40","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/a47fa41381a09e5997afd762664db4f5f6657e03","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T05:32:07.995Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2021-47290","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T15:39:25.848722Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-11T17:33:09.831Z"}}]}}}