targetcli-fb 2.1.50/2.1.51 and rtslib-fb through 2.1.72 (configuration tooling for the Linux LIO iSCSI/NVMe-oF target)

Impact

The targetclid socket is world-writable, so any local user on the storage node can drive the tool that configures LIO - creating backstores, changing LUN mappings and ACLs, and thereby escalating to root. The related defects leave /etc/target, its backup directory and saveconfig.json with weak permissions, exposing the entire target configuration including initiator ACLs and CHAP secrets to any local reader. Concretely: a non-root foothold on a storage node becomes 'map any tenant's LUN to an initiator I control', which is a cross-tenant data compromise achieved entirely through the target's own supported configuration path, leaving no memory-corruption artefacts to find afterwards.

Who can reach it

Any unprivileged local account on the LIO target host - a container escape, a compromised exporter or backup agent, a shared ops account. Requires that the targetclid socket unit is enabled, which several distributions do by default.

What to do

Distro package update for targetcli-fb and rtslib-fb; no reboot and no I/O interruption. Independently, mask targetclid.socket unless you actually use the daemon mode - most operators drive targetcli interactively or from configuration management and never need it. Fix permissions on /etc/target, its backups and saveconfig.json, and rotate any CHAP secrets that were stored there, since the file was readable before you fixed it.

References