Към съдържанието
Търсене

CVE-2026-90413: Linux

9.1

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: IB/isert: reject login PDUs declaring more data than was received isert_login_recv_done() records how many bytes the HCA actually placed in the login buffer, but nothing compares that against the length the login PDU's BHS declares. isert_rx_login_req() copies min(login_req_len, MAX_KEY_VALUE_PAIRS) bytes into login->req_buf, and the login code then reads the declared length back out of that buffer - for the first PDU in iscsi_target_locate_portal(), payload_length = ntoh24(login_req->dlength); tmpbuf = kmemdup_nul(login->req_buf, payload_length, GFP_KERNEL); and for the ones after it in iscsi_decode_text_input(), reached from iscsi_target_do_login(). login->req_buf is a fixed MAX_KEY_VALUE_PAIRS (8192) byte allocation, so an initiator that declares more than it sends reads off the end of it, before authentication and with the length under its control: BUG: KASAN: slab-out-of-bounds in kmemdup_nul+0x43/0x80 Read of size 8193 at addr ffff8881056a8000 by task iscsi_np/167 __asan_memcpy+0x23/0x60 kmemdup_nul+0x43/0x80 iscsi_target_locate_portal+0x48d/0x1180 iscsi_target_login_thread+0x19a9/0x3350 Allocated by task 167: __kmalloc_cache_noprof+0x158/0x370 iscsi_target_login_thread+0x971/0x3350 which belongs to the cache kmalloc-8k of size 8192 allocated 8192-byte region Falsifying the second login PDU instead reaches the other reader, on the same buffer: BUG: KASAN: slab-out-of-bounds in kmemdup_nul+0x43/0x80 Read of size 8193 at addr ffff888104d10000 by task kworker/1:1/50 Workqueue: isert_login_wq iscsi_target_do_login_rx __asan_memcpy+0x23/0x60 kmemdup_nul+0x43/0x80 iscsi_decode_text_input+0xc6/0x11c0 iscsi_target_do_login+0x261/0x1470 iscsi_target_do_login_rx+0x51d/0x7d0 iscsit over TCP is not exposed: iscsit_get_login_rx() validates the declared length with iscsi_target_check_login_request() and then reads exactly that many bytes off the s

    Засегнати продукти

    • Linux Linux: b8d26b3be8b33682cf163274ed07479a70554633 преди b1f3313e7b3e396e4985fea5c709477387e0a065; b8d26b3be8b33682cf163274ed07479a70554633 преди 228aaa620fe6a7bc8b5b21dd348b4836b1760c61; b8d26b3be8b33682cf163274ed07479a70554633 преди 0d9c0586af703890afe1bd0cfe641e3a3af1c32d; b8d26b3be8b33682cf163274ed07479a70554633 преди 44fe800ec13386c88bd5b32bcd1deaa1e17535d5; b8d26b3be8b33682cf163274ed07479a70554633 преди 71ec8bbfa4a183f1e623662f9cfbcd702e433bdb; b8d26b3be8b33682cf163274ed07479a70554633 преди c345d9d0b3eefc990bb90cf565325785aab06aab; b8d26b3be8b33682cf163274ed07479a70554633 преди 48812c8103071d550d9ab4a3431be5bdc52255bc; b8d26b3be8b33682cf163274ed07479a70554633 преди 2488b5b4827e5415768afc8daf097e8eb83c98df
    • Linux Linux: 3.10; преди 3.10; 5.10.270 до 5.10.*; 5.15.221 до 5.15.*; 6.1.188 до 6.1.*; 6.6.157 до 6.6.*; 6.12.110 до 6.12.*; 6.18.52 до 6.18.*; 7.2.6 до 7.2.*; от 7.3 нататък

    История

    • 17 септември 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-90413: Linux | freedomonline.bg