CVE-2024-45751: CHAP authentication bypass in user-space Linux target framework (tgt) up to v1.0.92
Published Sep 6, 2024
·Updated
Last updated 27 May 2026
Other sources
tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical.
— NVD
Affected Software
1 affected componentFixes available
debian/tgt<=1:1.0.80-1
1:1.0.80-1+deb11u11:1.0.85-1+deb12u11:1.0.85-1.3
Event History
Sep 6, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·05:15 AM
DescriptionSeverityWeakness
May 27, 2026
Data Sourced
via Launchpad·05:13 PM
Description
Data Sourced
via Debian·05:14 PM
DescriptionAffected Software
May 28, 2026
Data Sourced
via Ubuntu·05:14 PM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-45751?
CVE-2024-45751 is considered a low severity vulnerability due to predictable random number generation.
2
How do I fix CVE-2024-45751?
To resolve CVE-2024-45751, upgrade the tgt package to version 1.0.93 or later.
3
Which versions of tgt are affected by CVE-2024-45751?
CVE-2024-45751 affects tgt versions before 1.0.93, including 1.0.80 through 1.0.85.
4
What is the nature of the issue in CVE-2024-45751?
CVE-2024-45751 arises from using a non-random seed for the random number generator which leads to predictable outcomes.
5
Are there any workarounds for CVE-2024-45751?
There are no recommended workarounds for CVE-2024-45751; updating the package is the best course of action.