CVE-2021-47290

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: Fix NULL dereference on XCOPY completion

CPU affinity control added with commit 39ae3edda325 ("scsi: target: core:

Make completion affinity configurable") makes target_complete_cmd() queue

work on a CPU based on se_tpg->se_tpg_wwn->cmd_compl_affinity state.

LIO's EXTENDED COPY worker is a special case in that read/write cmds are

dispatched using the global xcopy_pt_tpg, which carries a NULL se_tpg_wwn

pointer following initialization in target_xcopy_setup_pt().

The NULL xcopy_pt_tpg->se_tpg_wwn pointer is dereferenced on completion of

any EXTENDED COPY initiated read/write cmds. E.g using the libiscsi

SCSI.ExtendedCopy.Simple test:

BUG: kernel NULL pointer dereference, address: 00000000000001a8

RIP: 0010:target_complete_cmd+0x9d/0x130 [target_core_mod]

Call Trace:

fd_execute_rw+0x148/0x42a [target_core_file]

? __dynamic_pr_debug+0xa7/0xe0

? target_check_reservation+0x5b/0x940 [target_c

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References