Linux kernel libiscsi: a malicious iSCSI target crashes the initiator with an unsolicited NOP-In

Impact

An iSCSI target, or anyone who can impersonate one on the storage network, can name any task slot in the initiator's command pool - including one that was never used - in a NOP-In, Text, Login, Logout or TMF response. iscsi_itt_to_task() only bounds the index against cmds_max, so task->conn is NULL and the response handler dereferences it, taking the host kernel down with a general protection fault. One unsolicited PDU is enough and the crash happens in softirq context on the receive path, so it needs no prior command from the initiator. On a GPU node that boots or mounts dataset volumes over iSCSI this is a host panic that kills every running job on the box, and a target that keeps sending can keep nodes down across reboots.

Who can reach it

Anyone able to act as, or spoof, the iSCSI target the node is connected to - typically a position on the storage VLAN. No authentication to the node itself, and no local access, is required; the initiator only has to have a session open.

What to do

Patch the host kernel to a stable release carrying the libiscsi fix (the record lists the git commits, not fixed version numbers) and reboot each affected node - the fix is in the iSCSI receive path and cannot be applied to a running kernel. Until then, keep iSCSI traffic on a segmented storage network with CHAP mutual authentication so an arbitrary host cannot present itself as the target.

References

Related entries

• OpenSSL: ChaCha20-Poly1305 accepts 16-byte nonces, silently ignoring leading bytesCVE-2019-1543 · OpenSSL (ChaCha20-Poly1305 variable nonce length)High
• Linux kernel (overlayfs, Ubuntu patch): OverlayFS file-capability privilege escalationCVE-2021-3493 · Linux kernel (overlayfs, Ubuntu patch)High
• OpenSSL: X.400 address type confusion in X.509 GeneralNameCVE-2023-0286 · OpenSSLHigh
• Linux kernel (net/sched tcindex): Use-after-free in the tcindex traffic-control filter - local rootCVE-2023-1829 · Linux kernel (net/sched tcindex)High
• OpenSSL: TLS/DTLS clients using raw public keys may not fail the handshake when the server is unauthenticatedCVE-2024-12797 · OpenSSL (RFC7250 raw public key server authentication)High
• QEMU: missing iov bounds check in the virtio-snd input callback gives a guest a heap out-of-bounds writeCVE-2026-3195 · QEMU virtio-snd device (virtio_snd_pcm_in_cb input callback)High