Double free vulnerability in the iscsirxhandler function (usr/iscsi/iscsid.c) in the tgt daemon (tgtd) in Linux SCSI target framework (tgt) before 1.0.14, aka scsi-target-utils, allows remote attackers to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via unknown vectors related to a buffer overflow during iscsi login. NOTE: some of these details are obtained from third party information.

It was reported that a stack buffer overflow vulnerability exists in multiple implementations of iSCSI target, including scsi-target-utils. A missing bounds check when handling SCN messages could result in a buffer overflow when the iSCSI Name string is longer than 1008 bytes, which could lead to corruption of sensitive stack data. During investigation, more buffer overflow vulnerabilities were discovered as well.

Acknowledgements:

Red Hat would like to thank the Vulnerability Research Team at TELUS Security Labs and Fujita Tomonori for responsibly reporting these flaws.