CVE-2013-2850: Buffer Overflow
A flaw was found in the way Linux kernel's iSCSI target processed large keys. If a key was larger than 64 bytes, as checked by iscsicheckkey(), the error response packet, generated by iscsiaddnotunderstoodresponse(), would still attempt to copy the entire key into the packet, overflowing the structure on the heap.
A remote attacker could use this flaw to escalate their privileges on the system.
Acknowledgements:
Red Hat would like to thank Kees Cook for reporting this issue.
Other sources
Heap-based buffer overflow in the iscsiaddnotunderstoodresponse function in drivers/target/iscsi/iscsitargetparameters.c in the iSCSI target subsystem in the Linux kernel through 3.9.4 allows remote attackers to cause a denial of service (memory corruption and OOPS) or possibly execute arbitrary code via a long key that is not properly handled during construction of an error-response packet.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2850?
CVE-2013-2850 has a medium severity due to the potential for a denial of service caused by a buffer overflow.
How do I fix CVE-2013-2850?
To fix CVE-2013-2850, upgrade to a version of the Linux kernel that is 5.10.223-1 or later, or 6.1.123-1 or later.
What systems are affected by CVE-2013-2850?
CVE-2013-2850 affects specific versions of the Linux kernel ranging from 3.1 to 3.9.5.
What types of attacks can exploit CVE-2013-2850?
CVE-2013-2850 can be exploited by sending specially crafted iSCSI requests with oversized keys.
Is CVE-2013-2850 still a concern in modern systems?
CVE-2013-2850 is less of a concern in modern systems that have applied the necessary kernel updates.