Linux kernel iSCSI target: login payload can fill the buffer with no NUL, so CHAP parsing reads past the slab

Impact

login->req_buf is allocated at exactly MAX_KEY_VALUE_PAIRS (8192) bytes and the length check uses '>', so a payload of 8189-8192 bytes fills it completely with no room for a terminator. The buffer is then consumed as a C string: kstrdup(), strstr() and strlen_semi() have no length bound, and convert_null_to_semi() rewrites embedded NULs to ';', so parsing walks into adjacent slab memory. This is reachable by an unauthenticated initiator against a portal configured for CHAP - when authentication is not required the AuthMethod is rewritten to None and the CHAP path is never entered. A Linux host exporting iSCSI LUNs to a GPU fleet is therefore attackable by anything that can open a TCP session to the portal. The fix allocates one extra zeroed byte.

Who can reach it

Network, unauthenticated - anyone who can reach the iSCSI portal (typically the storage VLAN) on a target configured to require CHAP. Targets that do not require authentication do not reach the vulnerable path.

What to do

Update to a stable kernel with the linked commits and reboot the target hosts; on an active storage target that means failing over or scheduling downtime for the LUNs it serves. Until then, restrict portal reachability to the storage network and known initiator addresses. No fixed release numbers appear in the record.

References

Related entries

• QEMU VGA device model (hw/display/vga.c) - banked access to video memory: 'Dark Portal' - the guest sets the VGA bankCVE-2016-3710 · QEMU VGA device model (hw/display/vga.c) - banked access to video memoryHigh
• Xen x86 PV pagetable update fast paths (arch/x86/mm.c): A 32-bit PV guest administrator gains full host privileges byCVE-2016-6258 · Xen x86 PV pagetable update fast paths (arch/x86/mm.c)High
• VMware ESXi (OpenSLP): OpenSLP heap overflow - the ESXiArgs ransomware entry point that mass-encrypted thousandsCVE-2021-21974 · VMware ESXi (OpenSLP)High
• Linux KVM x86 - stack out-of-bounds in ioapic_write_indirect(): A guest write to the virtual IOAPIC causes a stackCVE-2021-47390 · Linux KVM x86 - stack out-of-bounds in ioapic_write_indirect()High
• Xen (xenstored): Guest can crash xenstored, taking down control-plane services for all guests on the hostCVE-2022-42309 · Xen (xenstored)High
• Linux kernel drivers/vdpa/mlx5 (mlx5 vDPA net device): A guest with an assigned mlx5 vDPA net device sends anCVE-2022-48864 · Linux kernel drivers/vdpa/mlx5 (mlx5 vDPA net device)High