Buffer Overflow Vulnerability in Linux Kernel Affecting iSCSI Connections

CVE-2023-53676

What is CVE-2023-53676?

A vulnerability in the Linux kernel's handling of iSCSI connections has been identified, specifically within the lio_target_nacl_info_show() function. This function employs sprintf() inside a loop to output details for each iSCSI connection in a session. However, it fails to adequately verify the buffer's length, potentially allowing for a buffer overflow if an excessive number of iSCSI connections are active. This overflow can lead to memory corruption, which poses a significant security risk. The vulnerability has been addressed by replacing sprintf() with the safer sysfs_emit_at() function, which includes checks for buffer boundaries, thereby enhancing overall system security.

References