PT-2026-61204 · Linux · Linux
CVE-2026-63887
·
Publicado
2026-07-19
·
Atualizado
2026-07-19
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: iscsi: Bound iscsi encode text output() appends to rsp buf
iscsi encode text output() concatenates "key=value0" records into
login->rsp buf, an 8192-byte kzalloc(MAX KEY VALUE PAIRS) buffer
allocated in iscsit alloc login setup buffer(). The three sprintf() call
sites in this function (lines 1398, 1411, 1424 in v7.1-rc2) never check
the remaining buffer capacity:
*length += sprintf(output buf, "%s=%s", er->key, er->value);
*length += 1;
output buf = textbuf + *length;The 8192-byte ceiling at iscsi target check login request() bounds the
input Login PDU payload, but a single PDU can carry up to 2048 minimal
four-byte "a=b0" pairs, each unknown key expanding to a 16-byte
"a=NotUnderstood0" output record via iscsi add notunderstood response().
2048 * 16 = 32 KiB of output into an 8 KiB buffer, producing a ~24 KiB
heap overrun in the kmalloc-8k slab.
The fix introduces a static iscsi encode text record() helper that uses
snprintf() with a per-call bounds check against the remaining buffer,
and threads a u32 textbuf size parameter through
iscsi encode text output(). Both call sites in
iscsi target handle csg zero() (PHASE SECURITY) and
iscsi target handle csg one() (PHASE OPERATIONAL) pass
MAX KEY VALUE PAIRS. On overflow the encoder logs the condition, calls
iscsi release extra responses() to drop queued records, and returns -1;
both caller sites now emit ISCSI STATUS CLS INITIATOR ERR /
ISCSI LOGIN STATUS INIT ERR via iscsit tx login rsp() before returning,
so the initiator sees an explicit failed-login response rather than a
silent connection drop. (Prior to this patch only the PHASE OPERATIONAL
caller did that; the PHASE SECURITY caller is converted to the same
shape.)
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux