Към съдържанието
Търсене

CVE-2026-63888: Linux, грешка в паметта

9.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Two latent bugs in the Text-phase handler, both present since the original LIO integration in commit e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1"): 1) DataDigest CRC buffer overread (4 bytes past text_in). text_in is kzalloc()'d at ALIGN(payload_length, 4). rx_size is then incremented by ISCSI_CRC_LEN to make room for the received DataDigest in the iovec, but the same (now-bumped) rx_size is passed as the buffer length to iscsit_crc_buf(): if (conn->conn_ops->DataDigest) { ... rx_size += ISCSI_CRC_LEN; } ... if (conn->conn_ops->DataDigest) { data_crc = iscsit_crc_buf(text_in, rx_size, 0, NULL); iscsit_crc_buf() walks rx_size bytes of text_in with crc32c(), so when DataDigest is negotiated it reads 4 bytes past the end of the text_in allocation. KASAN reproduces this directly on the unpatched mainline tree as slab-out-of-bounds in crc32c() called from the Text PDU path. The OOB bytes feed crc32c() and are then compared against the initiator-supplied checksum, so the value does not flow back to the attacker, but the kernel does read past the buffer on every Text PDU with DataDigest=CRC32C. Fix by passing the actual padded payload length (ALIGN(payload_length, 4)) that was used for the kzalloc(). 2) Stale cmd->text_in_ptr re-free (double-free) on ERL>0 bad DataDigest drop. On DataDigest mismatch with ErrorRecoveryLevel > 0 the handler silently drops the PDU and lets the initiator plug the CmdSN gap: kfree(text_in); return 0; cmd->text_in_ptr still points at the freed buffer. The next Text Request on the same ITT re-enters iscsit_setup_text_cmd(), which unconditionally does kfree(cmd->text_in_ptr); cmd->text

Засегнати продукти

  • Linux Linux: e48354ce078c079996f89d715dfa44814b4eba01 преди f7948af0dd03de84079dcd4dc215a69fd6fbb95d; e48354ce078c079996f89d715dfa44814b4eba01 преди badf178b76b0690851df00f4ca9cf2eb8eb0f963; e48354ce078c079996f89d715dfa44814b4eba01 преди 6e22a1cdcc8277af4acc43710577157b77a02c5d; e48354ce078c079996f89d715dfa44814b4eba01 преди d3e9b79aa794f7a23e82de4d710e7d2df610e349; e48354ce078c079996f89d715dfa44814b4eba01 преди ec9f19d52074a191ed1756ed4a7d39fff1a2085c; e48354ce078c079996f89d715dfa44814b4eba01 преди 89c81d1228c00fa6dd91de6c1c5aa1ef8a7875e3; e48354ce078c079996f89d715dfa44814b4eba01 преди 5118ea225fe63b44207ba88047e4866e1ea43812; e48354ce078c079996f89d715dfa44814b4eba01 преди 778c2ab142c625a8a8afa570e0f9b7873f445d99
  • Linux Linux: 3.1; преди 3.1; 5.10.259 до 5.10.*; 5.15.210 до 5.15.*; 6.1.176 до 6.1.*; 6.6.143 до 6.6.*; 6.12.93 до 6.12.*; 6.18.35 до 6.18.*; 7.0.12 до 7.0.*; от 7.1 нататък

Вид слабост

История

  • 19 юли 2026 Публикувано

Други уязвимости в Linux Linux

Първоизточници