Executive brief
The Linux kernel's iSCSI target subsystem contains a buffer overflow vulnerability in the lio_target_nacl_info_show() function, which displays connection details in the configfs interface. An attacker with local access can create multiple iSCSI connections to trigger unbounded memory writes, leading to kernel memory corruption, denial of service, or potential privilege escalation.
Technical details
The vulnerability is a classic buffer overflow in the kernel's SCSI/iSCSI target subsystem. The lio_target_nacl_info_show() function uses sprintf() in a loop to write session and connection details to a fixed-size configfs buffer without bounds checking. By creating enough iSCSI connections within a session, an attacker can overflow the provided buffer and corrupt adjacent kernel memory. The fix replaces sprintf() with sysfs_emit_at(), which enforces buffer boundary checks. The vulnerability requires local system access to configure iSCSI sessions, and affects multiple Linux kernel versions across 4.x, 5.x, and 6.x series.
Affected products
- Linux Linux kernel 4.0 through 6.x
Timeline
- 2025-10-07: disclosed: CVE-2023-53676 published
- 2023-09-23: patched: Fix merged into stable Linux kernel (commit 0cac6cbb9908309352a5d30c1876882771d3da50)