CVE-2022-50350

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: iscsi: Fix a race condition between login_work and the login thread

In case a malicious initiator sends some random data immediately after a

login PDU; the iscsi_target_sk_data_ready() callback will schedule the

login_work and, at the same time, the negotiation may end without clearing

the LOGIN_FLAGS_INITIAL_PDU flag (because no additional PDU exchanges are

required to complete the login).

The login has been completed but the login_work function will find the

LOGIN_FLAGS_INITIAL_PDU flag set and will never stop from rescheduling

itself; at this point, if the initiator drops the connection, the

iscsit_conn structure will be freed, login_work will dereference a released

socket structure and the kernel crashes.

BUG: kernel NULL pointer dereference, address: 0000000000000230

PF: supervisor write access in kernel mode

PF: error_code(0x0002) - not-present page

Workqueue: events iscsi_target_do_login_rx [is

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References