CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's handling of SCSI responses, specifically in the iscsi_scsi_cmd_rsp() function, which improperly checks the data length against the sense length. This oversight can lead to the exposure of stale data in the SCSI sense buffer, potentially allowing unauthorized access to sensitive information. Organizations using Linux systems that handle SCSI commands should prioritize this issue to mitigate risks associated with data leakage.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer iscsi_scsi_cmd_rsp() copies the sense data of a SCSI Response from the target-supplied data segment. The segment carries a 2-byte sense length followed by the sense bytes, so it must hold 2 + senselen bytes, but the bounds check only requires datalen >= senselen: senselen = get_unaligned_be16(data); if (datalen < senselen) goto invalid_datalen; memcpy(sc->sense_buffer, data + 2, min_t(uint16_t, senselen, SCSI_SENSE_BUFFERSIZE)); A target that returns a SCSI Response whose datalen equals senselen (with senselen <= SCSI_SENSE_BUFFERSIZE) makes the memcpy() from data + 2 read up to two bytes past the received data. Those bytes are stale conn->data contents and end up in the command's sense buffer, which is returned to userspace. Account for the 2-byte sense length prefix in the check.