Unique np Under Each TPG in scsi: target: iscsi
Summary
GSD-2022-1000333: scsi: target: iscsi: Make sure the np under each tpg is unique. Affects Kernel versions < c6a7077144ed291cfbf736875ad0fe89e6291f02. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The scsi: target: iscsi package is a component of the Linux Kernel. It provides support for the iSCSI (Internet Small Computer System Interface) protocol, allowing storage devices to be shared over a network. The package includes functionality for creating and managing target portal groups (TPGs) which represent a collection of iSCSI targets. Each TPG can have multiple network portals (np) associated with it, which are used for communication. However, a vulnerability exists where the np under each TPG is not guaranteed to be unique.
Vulnerability Detail
The vulnerability in scsi: target: iscsi arises from the lack of uniqueness of the np under each TPG. This can lead to various issues, such as incorrect routing of network traffic or potential data corruption. An attacker could potentially exploit this vulnerability to manipulate network traffic or disrupt the functionality of the iSCSI targets. The vulnerability has been fixed in Linux Kernel version v5.4.180 by commit c6a7077144ed291cfbf736875ad0fe89e6291f02.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The scsi: target: iscsi package in the Linux Kernel is vulnerable to a lack of uniqueness in the np under each TPG. This can have various consequences, including incorrect routing of network traffic and potential data corruption. It is crucial to update the Linux Kernel to version v5.4.180 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
scsi: target: iscsi is a package in the Linux Kernel that provides support for the iSCSI protocol, allowing storage devices to be shared over a network.
A TPG (target portal group) in scsi: target: iscsi represents a collection of iSCSI targets. It helps in organizing and managing the targets.
An np (network portal) in scsi: target: iscsi is a network endpoint used for communication with iSCSI targets.
The lack of uniqueness of the np under each TPG can result in incorrect routing of network traffic or potential data corruption. This could lead to disruptions in the functionality of iSCSI targets or potential exploitation by attackers.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.4.180 or later. Follow the official update process for your Linux distribution.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
