Linux kernel - iSER (iSCSI Extensions for RDMA) target, drivers/infiniband/ulp/isert/ib_isert.c: TENANT ISOLATION

Impact

TENANT ISOLATION: The iSER target accepted login PDUs shorter than ISER_HEADERS_LEN and parsed them anyway, giving out-of-bounds access in the kernel before any authentication has occurred. Login is by definition the pre-auth surface, so anyone who can reach the iSER target port gets remote kernel compromise on the storage node with no credentials at all. A storage node in a GPU cluster typically mounts and serves many tenants' volumes, so compromising it is equivalent to compromising every dataset it fronts.

Who can reach it

Connect to the iSER target and send a truncated login PDU. Fully pre-authentication, no valid initiator identity required, reachable from anywhere on the storage fabric. If the storage fabric is not separated from the tenant fabric - a common shortcut - this is reachable from tenant workloads directly.

What to do

Host reboot / kernel upgrade on iSER target nodes, treated as urgent given it is pre-auth and scored 9.8. Immediate config controls while you schedule the reboot: restrict the iSER/iSCSI target port to known initiator addresses at the switch and host firewall, and place storage targets on a fabric partition tenants cannot reach. If iSER is unused, unload ib_isert and disable the target configuration.

References