NetSight
IP …
high8.8

CVE-2023-53676

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() The function lio_ta…

Impact

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() The function lio_target_nacl_info_show() uses sprintf() in a loop to print details for every iSCSI connection in a session without checking for the buffer length. With enough iSCSI connections it's possible to overflow the buffer provided by configfs and corrupt the memory. This patch replaces sprintf() with sysfs_emit_at() that checks for buffer boundries.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 3.1 before 4.14.326
from 4.15 before 4.19.295
from 4.20 before 5.4.257
from 5.5 before 5.10.197
from 5.11 before 5.15.133
from 5.16 before 6.1.55

Weakness classification

CWE-787

References