CVE-2021-47328CWE-416

CVE-2021-47328

Critical · published May 21, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
55.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

scsi: iscsi: Fix conn use after free during resets

If we haven't done a unbind target call we can race where

iscsi_conn_teardown wakes up the EH thread and then frees the conn while

those threads are still accessing the conn ehwait.

We can only do one TMF per session so this just moves the TMF fields from

the conn to the session. We can then rely on the

iscsi_session_teardown->iscsi_remove_session->__iscsi_unbind_session call

to remove the target and it's devices, and know after that point there is

no device or scsi-ml callout trying to access the session.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00766 · 55.0th percentile
Weakness
CWE-416 · Use After Free
Published
2024-05-21T19:15Z
Affected products (5)
ProductVersionsFixed in
linux/linux_kernel< 4.19.1984.19.198
linux/linux_kernel≥ 4.20, < 5.4.1345.4.134
linux/linux_kernel≥ 5.5, < 5.10.525.10.52
linux/linux_kernel≥ 5.11, < 5.12.195.12.19
linux/linux_kernel≥ 5.13, < 5.13.45.13.4
References (12)
EPSS history
Timeline
  • 21 MAY 14:35Z
    scsi: iscsi: Fix conn use after free during resets
    cvelistv5