Race Condition in Linux Kernel's iSCSI Implementation by Linux

CVE-2022-50350

What is CVE-2022-50350?

A vulnerability in the iSCSI implementation of the Linux kernel allows a malicious initiator to exploit a race condition between the login process and the login thread. If harmful data is sent after a login PDU, the callback iscsi_target_sk_data_ready() may schedule login work while the negotiation phase fails to clear the LOGIN_FLAGS_INITIAL_PDU flag. This results in a scenario where the login completes, but login_work remains active, leading to repeated scheduling. If the initiator disconnects during this state, it causes a NULL pointer dereference, resulting in a kernel crash and potential system instability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References