CVE-2013-2850

Published: 30 May 2013

Heap-based buffer overflow in the iscsi_add_notunderstood_response function in drivers/target/iscsi/iscsi_target_parameters.c in the iSCSI target subsystem in the Linux kernel through 3.9.4 allows remote attackers to cause a denial of service (memory corruption and OOPS) or possibly execute arbitrary code via a long key that is not properly handled during construction of an error-response packet. A reproduction case requires patching open-iscsi to send overly large keys. Performing discovery in a loop will Oops the remote server. Attached is a proposed fix, and the patch I used in open-iscsi to trigger it. Thanks in advance for your cooperation in coordinating a fix for this issue,

From the Ubuntu security team

Kees Cook discovered a flaw in the Linux kernel's iSCSI subsystem. A remote unauthenticated attacker could exploit this flaw to cause a denial of service (system crash) or potentially gain administrative privileges.

Notes

Patch not yet upstream

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2850
• https://ubuntu.com/security/notices/USN-1844-1
• https://ubuntu.com/security/notices/USN-1845-1
• https://ubuntu.com/security/notices/USN-1846-1
• https://ubuntu.com/security/notices/USN-1847-1
• https://ubuntu.com/security/notices/USN-1849-1
• https://ubuntu.com/security/notices/USN-1879-1
• https://ubuntu.com/security/notices/USN-1882-1
• https://ubuntu.com/security/notices/USN-1883-1
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1185990