CVE-2023-54184
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In the Linux kernel, in the scsi: target: iscsit module, there is a vulnerability where commands from recovery entries are freed after the session has been closed, leading to use-after-free or NULL pointer dereference. The fix moves cleanup of recovery entries to before session freeing.
Risk Assessment
The risk is a potential system crash (kernel panic) or unpredictable behavior in iSCSI environments, which could affect service availability.
Recommendation
It is recommended to apply the kernel patch that moves cleanup of recovery entries before session freeing and update systems to a kernel version containing this fix.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsit: Free cmds before session free Commands from recovery entries are freed after session has been closed. That leads to use-after-free at command free or NPE with such call trace: Time2Retain timer expired for SID: 1, cleaning up iSCSI session. BUG: kernel NULL pointer dereference, address: 0000000000000140 RIP: 0010:sbitmap_queue_clear+0x3a/0xa0 Call Trace: target_release_cmd_kref+0xd1/0x1f0 [target_core_mod] transport_generic_free_cmd+0xd1/0x180 [target_core_mod] iscsit_free_cmd+0x53/0xd0 [iscsi_target_mod] iscsit_free_connection_recovery_entries+0x29d/0x320 [iscsi_target_mod] iscsit_close_session+0x13a/0x140 [iscsi_target_mod] iscsit_check_post_dataout+0x440/0x440 [iscsi_target_mod] call_timer_fn+0x24/0x140 Move cleanup of recovery enrties to before session freeing.