Linux kernel - LIO iSCSI target CHAP authentication, drivers/target/iscsi/iscsi_target_auth.c: TENANT ISOLATION

Impact

TENANT ISOLATION: chap_server_compute_hash() allocated the client digest buffer at the hash's digest size, then passed a base64 CHAP_R response to the decoder without checking whether the input could produce more output than that. Up to 127 base64 characters decode to 95 bytes - a 63-byte overflow for SHA-256, 79 bytes for MD5 - and the existing length check fired only after the write had already happened. This is a heap overflow reached during CHAP authentication, meaning pre-authentication by definition: anyone who can open an iSCSI session to the target gets a controlled kernel heap write on the storage node. The HEX branch of the same switch already validated its length, so the bug was a straightforward omission on the base64 path.

Who can reach it

Open an iSCSI session to the LIO target and send a CHAP_R value with the '0b' base64 prefix and a long payload. No valid credentials required - the overflow happens while the target is still working out whether your credentials are valid. Reachable from any host that can reach the iSCSI port.

What to do

Host reboot / kernel upgrade on all LIO iSCSI target nodes - urgent, pre-auth, 9.8. Interim controls: restrict the iSCSI target port to known initiator addresses at the firewall and switch, and if CHAP is not required, note that disabling it does not help since the parser is reached during login negotiation. Move iSCSI targets off tenant-reachable networks. Where the iSCSI target is legacy, decommissioning it is the cleanest fix.

References