CVE-2021-27363

Published: 7 March 2021

An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle is available to unprivileged users via the sysfs file system, at /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the show_transport_handle function (in drivers/scsi/scsi_transport_iscsi.c) is called, which leaks the handle. This handle is actually the pointer to an iscsi_transport struct in the kernel module's global variables.

From the Ubuntu security team

Adam Nichols discovered that the iSCSI subsystem in the Linux kernel did not properly restrict access to iSCSI transport handles. A local attacker could use this to cause a denial of service or expose sensitive information (kernel pointer addresses).

Priority

Medium

CVSS 3 base score: 4.4

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27363
• https://git.kernel.org/linus/688e8128b7a92df982709a4137ea4588d16f24aa
• http://www.openwall.com/lists/oss-security/2021/03/06/1
• https://bugzilla.suse.com/show_bug.cgi?id=1182716
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=688e8128b7a92df982709a4137ea4588d16f24aa
• https://ubuntu.com/security/notices/USN-4883-1
• https://ubuntu.com/security/notices/USN-4887-1
• https://ubuntu.com/security/notices/USN-4889-1
• https://ubuntu.com/security/notices/USN-4901-1
• NVD
• Launchpad
• Debian

Bugs