Executive brief
The Linux kernel's iSCSI over TCP driver has a race condition where accessing socket information via sysfs can crash the system if the socket is being released at the same time. This affects systems using iSCSI storage protocol and can cause service interruption or a kernel panic.
Technical details
This is a null pointer dereference vulnerability in the iscsi_tcp driver (drivers/scsi/iscsi_tcp.c) caused by a race condition between socket parameter access and socket release. The vulnerability occurs when iscsi_sw_tcp_conn_get_param() or iscsi_sw_tcp_host_get_param() call kernel_getpeername() while simultaneously iscsi_sw_tcp_release_conn() is releasing the socket, leading to a dereference of a NULL sock->ops pointer. The root cause is improper reference counting: the code held a reference to "struct sock" but needed one on "struct socket". The fix replaces spinlock-based synchronization with a dedicated mutex (sock_lock) to serialize access to the socket between interface code paths and the release path.
Affected products
- Linux Linux kernel prior to commit 57569c37f0add1b6489e1a1563c71519daf732cf
Timeline
- 2022-09-07: disclosed
- 2022-09-25: patched: Upstream fix merged by Martin K. Petersen
- 2022-10-21: other: Backported to stable kernels