Linux Kernel Data Digest CRC Overread and Double-Free Vulnerability in iSCSI Target

A vulnerability in the Linux kernel's iSCSI target implementation has been addressed. This issue involves a buffer overread and a double-free condition in the Text-phase command handler. The buffer overread occurs when the DataDigest CRC is processed, leading to a read operation that exceeds the allocated memory. This flaw, present since the initial integration of iSCSI support in version 4.1, can be reproduced using the Kernel Address Sanitizer (KASAN) tool. The double-free issue arises when a Text Request is dropped due to a DataDigest mismatch, causing the same memory to be freed multiple times, which can lead to memory corruption or a remote kernel bug on certain system configurations.

Impact

Exploitation of the buffer overread vulnerability allows for a memory access violation, where the kernel reads beyond the allocated buffer. This can disrupt normal operation and, on non-hardened kernels, corrupt the memory management system's free list. The double-free vulnerability can cause a remote kernel bug on hardened kernels or corrupt the memory free list on non-hardened kernels.

Reproduction

The vulnerability can be reproduced by sending a sequence of three Text Requests over iSCSI, after establishing a connection and logging in. The first request should be valid, which will trigger the double-free condition on the subsequent requests. This sequence can be automated with a script or tool that interacts with the iSCSI target, such as 'iscsiadm' or a custom application that sends iSCSI Text PDUs.

Remediation

Users can upgrade to the patched version of the Linux kernel available in the Linux Kernel Git Repository. Instructions for downloading the latest stable version can be found in the repository's release notes.