Linux kernel LIO iSCSI target: per-connection configfs output overflows the buffer with enough sessions

Impact

The LIO iSCSI target printed one line per connection into a fixed configfs buffer with sprintf and no bounds check, so a session carrying enough connections overflows the page configfs supplies and corrupts adjacent kernel memory. The number of connections is controlled by the iSCSI initiator, while the overflow fires when an administrator or monitoring agent reads the configfs info attribute - so a remote initiator supplies the data and a local read detonates it. This is relevant to operators who export block storage to GPU nodes from Linux hosts running LIO; a panic there takes down the storage path for every node attached to that target.

Who can reach it

Two parties: an iSCSI initiator that can establish a session with many connections to the target (authentication depends on your ACL/CHAP configuration), plus a local read of the target's configfs info attribute, which monitoring and management tooling does routinely. Only hosts acting as LIO iSCSI targets are affected; GPU compute nodes acting purely as initiators are not.

What to do

Update the storage hosts to a fixed stable kernel (commits in the record, which replace sprintf with sysfs_emit_at) and reboot them. Rebooting an iSCSI target means failing over or taking the exported LUNs offline, so sequence it with the clients that depend on it. Interim mitigations: restrict which initiators may log in, and avoid automated polling of the target's configfs info attributes.

References

Related entries

• Linux kernel (net/smc): Closing an SMC socket can leave the internal TCP kernel socket with its timers still armed andCVE-2023-53781 · Linux kernel (net/smc)High
• Linux kernel bpf: reused slab objects leave htab special fields stale, causing hard lockupCVE-2023-53790 · Linux kernel BPF memory allocator (non-preallocated htab map values)High
• Linux kernel (drivers/iommu/iommufd): The destroy ioctl takes a temporary reference on an iommufd object without theCVE-2023-53795 · Linux kernel (drivers/iommu/iommufd)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A use-after-free in the amdkfd (KFD compute driverCVE-2023-53816 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel bpf/sockmap: SKB refcount race gives use-after-free in the backlog workerCVE-2023-53836 · Linux kernel BPF sockmap (sk_psock_backlog SKB refcount)High
• Linux kernel sched/psi: use-after-free when a cgroup is removed under a poll() on its pressure fileCVE-2023-54019 · Linux kernel sched/psi (cgroup pressure-stall trigger polling)High