CVE-2024-45751: CHAP authentication bypass in user-space Linux target framework (tgt) up to v1.0.92
Last updated 27 May 2026
Other sources
tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/tgtto a version that resolves this vulnerability.Fixed in 1:1.0.85-1+deb12u1 - Upgrade
Upgrade
debian/tgtto a version that resolves this vulnerability.Fixed in 1:1.0.85-1.3 - Upgrade
Upgrade
debian/tgtto a version that resolves this vulnerability.Fixed in 1:1.0.85-1+deb12u1Fixed in 1:1.0.85-1.3 - Upgrade
Upgrade
tgtto a version that resolves this vulnerability.Fixed in 1.0.93
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45751?
CVE-2024-45751 is considered a low severity vulnerability due to predictable random number generation.
How do I fix CVE-2024-45751?
To resolve CVE-2024-45751, upgrade the tgt package to version 1.0.93 or later.
Which versions of tgt are affected by CVE-2024-45751?
CVE-2024-45751 affects tgt versions before 1.0.93, including 1.0.80 through 1.0.85.
What is the nature of the issue in CVE-2024-45751?
CVE-2024-45751 arises from using a non-random seed for the random number generator which leads to predictable outcomes.
Are there any workarounds for CVE-2024-45751?
There are no recommended workarounds for CVE-2024-45751; updating the package is the best course of action.