CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: iscsi: Fix buffer overflow in liotargetnaclinfoshow()
The function liotargetnaclinfoshow() uses sprintf() in a loop to print details for every iSCSI connection in a session without checking for the buffer length. With enough iSCSI connections it's possible to overflow the buffer provided by configfs and corrupt the memory.
This patch replaces sprintf() with sysfsemitat() that checks for buffer boundries.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()
Event History
Frequently Asked Questions
What is the severity of CVE-2023-53676?
CVE-2023-53676 has been classified with a moderate severity due to the potential for buffer overflow leading to denial of service.
How do I fix CVE-2023-53676?
To fix CVE-2023-53676, you should update to the latest stable version of the Linux kernel where this vulnerability has been patched.
What products are affected by CVE-2023-53676?
CVE-2023-53676 affects the Linux kernel, specifically regarding the iSCSI implementation.
What type of vulnerability is CVE-2023-53676?
CVE-2023-53676 is a buffer overflow vulnerability within the Linux kernel's iSCSI target subsystem.
Can CVE-2023-53676 be exploited remotely?
Yes, CVE-2023-53676 can potentially be exploited remotely if an attacker has access to the iSCSI service.