Microsoft iSNS Server service (Internet Storage Name Service for iSCSI discovery): Memory corruption in the iSNS Server

Impact

Memory corruption in the iSNS Server service leading to remote code execution, with an earlier integer-overflow variant in the same service. iSNS is the discovery registry for an iSCSI fabric: it tells initiators which targets and portals exist and which discovery domains they belong to. Code execution there gives an attacker the ability to re-point initiators at targets of their choosing, which is a fabric-wide man-in-the-middle on block storage without ever touching a target or a host. Discovery domains are also the iSCSI analogue of FC zoning, so controlling iSNS is controlling who can see whose LUNs.

Who can reach it

Any host that can reach the iSNS server's registration port (TCP 3205) on the storage or management network. No authentication - iSNS has essentially none in common deployments.

What to do

Patch the Windows host running the iSNS Server role and reboot. Better: most iSCSI deployments in a GPU datacenter do not need iSNS at all - initiators are configured with explicit target portals by the provisioning system. If that describes you, remove the iSNS Server role and strip the iSNS configuration from initiators; that removes an unauthenticated fabric-control service permanently and costs nothing operationally. If you do need it, put port 3205 behind an ACL that only initiator hosts can traverse.

References