targetcli-fb 2.1.50/2.1.51 and rtslib-fb through 2.1.72 (configuration tooling for the Linux LIO iSCSI/NVMe-oF target)

Impact

The targetclid socket is world-writable, so any local user on the storage node can drive the tool that configures LIO - creating backstores, changing LUN mappings and ACLs, and thereby escalating to root. The related defects leave /etc/target, its backup directory and saveconfig.json with weak permissions, exposing the entire target configuration including initiator ACLs and CHAP secrets to any local reader. Concretely: a non-root foothold on a storage node becomes 'map any tenant's LUN to an initiator I control', which is a cross-tenant data compromise achieved entirely through the target's own supported configuration path, leaving no memory-corruption artefacts to find afterwards.

Who can reach it

Any unprivileged local account on the LIO target host - a container escape, a compromised exporter or backup agent, a shared ops account. Requires that the targetclid socket unit is enabled, which several distributions do by default.

What to do

Distro package update for targetcli-fb and rtslib-fb; no reboot and no I/O interruption. Independently, mask targetclid.socket unless you actually use the daemon mode - most operators drive targetcli interactively or from configuration management and never need it. Fix permissions on /etc/target, its backups and saveconfig.json, and rotate any CHAP secrets that were stored there, since the file was readable before you fixed it.

References

Related entries

• IBM Platform LSF / Spectrum LSF Suite (debug configuration file permissions): With specific debug settings enabled, LSFCVE-2020-4278 · IBM Platform LSF / Spectrum LSF Suite (debug configuration file permissions)High
• IBM Spectrum LSF / LSF Suite (authentication, hard-coded credentials): A user who is merely allowed to submit LSF jobsCVE-2020-4983 · IBM Spectrum LSF / LSF Suite (authentication, hard-coded credentials)High
• AMD System Management Unit (SMU) mailbox interface: A malicious user can manipulate SMU mailbox entries and reachCVE-2021-26331 · AMD System Management Unit (SMU) mailbox interfaceHigh
• Linux iSCSI: iSCSI netlink structures lack length checksCVE-2021-27365 · Linux iSCSIHigh
• IBM Spectrum Scale core component (format string handling): A user with a shell on any node that runs Storage ScaleCVE-2021-29740 · IBM Spectrum Scale core component (format string handling)High
• Intel Virtual RAID on CPU (VROC) software before 7.7.6.1003, with follow-on issues through 8.6.0.1191: Use-after-freeCVE-2022-29919 · Intel Virtual RAID on CPU (VROC) software before 7.7.6.1003, with follow-on issues through 8.6.0.1191High