Nixpkgs security tracker

Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestion detail

Dismissed
(max. allowed matches exceeded)
created 3 weeks, 4 days ago Activity log
  • Created & dismissed (max. allowed matches exceeded) suggestion
scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer iscsi_scsi_cmd_rsp() copies the sense data of a SCSI Response from the target-supplied data segment. The segment carries a 2-byte sense length followed by the sense bytes, so it must hold 2 + senselen bytes, but the bounds check only requires datalen >= senselen: senselen = get_unaligned_be16(data); if (datalen < senselen) goto invalid_datalen; memcpy(sc->sense_buffer, data + 2, min_t(uint16_t, senselen, SCSI_SENSE_BUFFERSIZE)); A target that returns a SCSI Response whose datalen equals senselen (with senselen <= SCSI_SENSE_BUFFERSIZE) makes the memcpy() from data + 2 read up to two bytes past the received data. Those bytes are stale conn->data contents and end up in the command's sense buffer, which is returned to userspace. Account for the 2-byte sense length prefix in the check.

Affected products

Linux
  • <1f07a897d43c63e6c9458bf77450defef39b5833
  • ==2.6.18
  • <3ef209ca0b4b68c75e9a814d90cc916026b5a6ac
  • <2.6.18
  • <98b87885de4b7f605533a2860685f5689fce8e82
  • <7567f06abdefb1caf2d836107c4d08c5185c650e
  • =<6.6.*
  • =<*
  • <60499924faf4ef97e84228c20515218ef121facf
  • =<6.18.*
  • =<6.12.*
  • =<7.1.*