Description
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Reserve a terminator byte for the login payload iscsi_target_check_login_request() rejects a login PDU whose DataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test is '>' and login->req_buf is allocated with exactly MAX_KEY_VALUE_PAIRS bytes. Since iscsit_get_login_rx() receives payload_length + padding bytes, where padding = ((-payload_length) & 3); any payload_length from 8189 to 8192 fills the whole 8192 byte buffer. The write stays in bounds, but no byte is left for a NUL terminator. The buffer is subsequently consumed as a C string. In the CHAP path chap_check_algorithm() calls kstrdup(a_str), and extract_param() calls strstr(in_buf, pattern) followed by strlen_semi(), none of which take a length. convert_null_to_semi() additionally rewrites every embedded NUL to ';', so even a payload made of well formed NUL separated key=value records is left without a terminator. These walk past the end of the object into adjacent slab memory. It is reachable by an unauthenticated initiator against a portal configured for CHAP; when authentication is not required iscsi_login_zero_tsih_s2() rewrites AuthMethod to None and the CHAP path is never entered. Allocate one extra byte. kzalloc() zeroes it and nothing ever writes to it, as every writer copies to offset 0 for at most MAX_KEY_VALUE_PAIRS bytes, so the buffer is always terminated.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
e48354ce078c079996f89d715dfa44814b4eba01 to < 5fac79f248c37774d1dd761406f83d25ca6ff8e4affectede48354ce078c079996f89d715dfa44814b4eba01 to < 6ddddcad436d8e6e619204d3c848147ff2f5bf1eaffectede48354ce078c079996f89d715dfa44814b4eba01 to < b19dc17ed963ac36c0db4b52a1803fb11169f91faffectede48354ce078c079996f89d715dfa44814b4eba01 to < 6b589ef9d5f6cdc70d2b4f269ca6cf26b5ebb076affectede48354ce078c079996f89d715dfa44814b4eba01 to < eb9dadf4d552ebe10644871c5189286552aa48f5affectede48354ce078c079996f89d715dfa44814b4eba01 to < 1624bff4c5118ad494d50ad94d44f22064667a7faffectede48354ce078c079996f89d715dfa44814b4eba01 to < 3ddf3ea291a0ef2ea93b82e158960ac2cc42302baffectede48354ce078c079996f89d715dfa44814b4eba01 to < f4825922d2fb371e2b969697d792077f1b62b62caffected
Linux Linux
Default version status: affected
3.1affected0 to < 3.1unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.51 to ≤ 6.18.*unaffected7.2.5 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/5fac79f248c37774d1dd761406f83d25ca6ff8e4 ↗
- https://git.kernel.org/stable/c/6ddddcad436d8e6e619204d3c848147ff2f5bf1e ↗
- https://git.kernel.org/stable/c/b19dc17ed963ac36c0db4b52a1803fb11169f91f ↗
- https://git.kernel.org/stable/c/6b589ef9d5f6cdc70d2b4f269ca6cf26b5ebb076 ↗
- https://git.kernel.org/stable/c/eb9dadf4d552ebe10644871c5189286552aa48f5 ↗
- https://git.kernel.org/stable/c/1624bff4c5118ad494d50ad94d44f22064667a7f ↗
- https://git.kernel.org/stable/c/3ddf3ea291a0ef2ea93b82e158960ac2cc42302b ↗
- https://git.kernel.org/stable/c/f4825922d2fb371e2b969697d792077f1b62b62c ↗