In the Linux kernel, the following vulnerability has been resolved: scsi: target: Bound PR-OUT TransportID parsing to the received buffer core_scsi3_decode_spec_i_port() and core_scsi3_emulate_regi…
Critical CVSS 9.8
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: target: Bound PR-OUT TransportID parsing to the received buffer core_scsi3_decode_spec_i_port() and core_scsi3_emulate_register_and_move() hand the raw PERSISTENT RESERVE OUT parameter buffer to target_parse_pr_out_transport_id() without telling it how many bytes are valid. For an iSCSI TransportID (FORMAT CODE 01b), iscsi_parse_pr_out_transport_id() locates the ",i,0x" ISID separator with an unbounded strstr() (and on…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://git.kernel.org/stable/c/004ccd2d3b4ac36a300e05e01df152e5c02a5a82
- https://git.kernel.org/stable/c/03fbc7de8d5e85fc8420e57e8304c855efd453ab
- https://git.kernel.org/stable/c/555a89846ed888d7401b3f7200934c0fbedcbb46
- https://git.kernel.org/stable/c/6ca5de8782e67573a61a6736b6dc0ffe58dcdf59
- https://git.kernel.org/stable/c/842248047ef28dbf3b3f7f49a0ec315054d4dab8
- https://git.kernel.org/stable/c/88c67c3de914e19172e1d878a7625c5b06c20ec5
- https://git.kernel.org/stable/c/9298078a8f7d8181a04614a34ab655ccdf038204
- https://git.kernel.org/stable/c/d04a179085c262c9ed577d0a4cbc6482ff1fd9a3
Timeline
- nvd_ingest NVD