243 lines
12 KiB
JSON
243 lines
12 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2022-21546",
|
||
"assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "oracle",
|
||
"dateReserved": "2021-11-15T19:29:08.898Z",
|
||
"datePublished": "2025-05-02T21:52:09.864Z",
|
||
"dateUpdated": "2026-08-05T08:51:31.985Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"shortName": "Linux",
|
||
"dateUpdated": "2026-08-05T08:51:31.985Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: Fix WRITE_SAME No Data Buffer crash\n\nIn newer version of the SBC specs, we have a NDOB bit that indicates there\nis no data buffer that gets written out. If this bit is set using commands\nlike \"sg_write_same --ndob\" we will crash in target_core_iblock/file's\nexecute_write_same handlers when we go to access the se_cmd->t_data_sg\nbecause its NULL.\n\nThis patch adds a check for the NDOB bit in the common WRITE SAME code\nbecause we don't support it. And, it adds a check for zero SG elements in\neach handler in case the initiator tries to send a normal WRITE SAME with\nno data buffer."
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||
"baseScore": 7.5,
|
||
"baseSeverity": "HIGH"
|
||
},
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "AV:N - The vulnerable WRITE_SAME handlers live in fabric-independent LIO target core and are reached by SCSI CDBs delivered over network fabrics, principally iscsi_target on TCP/3260 (also isert/cxgbit), so a remote initiator can trigger the crash.\nAC:L - Sending a single WRITE_SAME(16/32) with the NDOB bit (or zero data-out length) deterministically leaves t_data_sg NULL and hits the NULL dereference; the attacker controls the CDB/flags and needs no race or special memory layout.\nPR:N - LIO iSCSI portals are routinely deployed with authentication=0 and generate_node_acls=1, and NDOB/zero-xfer yields DMA_NONE which bypasses lun_access_ro write-protect checks, so an unauthenticated network peer can obtain a nexus and issue the command.\nUI:N - Exploitation is solely attacker-driven iSCSI/SCSI traffic; no local user or administrator action is required once the target portal is listening.\nS:U - The NULL dereference oopses the same host kernel that implements the target; impact stays within that kernel’s security authority with no VM/IOMMU/sandbox boundary crossed.\nC:N - This is a pure NULL pointer dereference of se_cmd->t_data_sg with no attacker-controlled offset, OOB read, or data returned to the initiator, so nothing is disclosed.\nI:N - No memory is written and no corrupted object is reused; the fault occurs on a read of sg->length / t_data_sg[0] before any store or control-flow hijack primitive exists.\nA:H - The NULL dereference produces a kernel oops/panic (especially with panic_on_oops) in the target command path and can be re-triggered at will by a remote initiator, taking down the storage host."
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "unaffected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"drivers/target/target_core_file.c",
|
||
"drivers/target/target_core_iblock.c",
|
||
"drivers/target/target_core_sbc.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "f6970ad31d42fceb38b5595cbad093a4d0bfcc43",
|
||
"lessThan": "54e57be2573cf0b8bf650375fd8752987b6c3d3b",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "f6970ad31d42fceb38b5595cbad093a4d0bfcc43",
|
||
"lessThan": "d8e6a27e9238dd294d6f2f401655f300dca20899",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "f6970ad31d42fceb38b5595cbad093a4d0bfcc43",
|
||
"lessThan": "4226622647e3e5ac06d3ebc1605b917446157510",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "f6970ad31d42fceb38b5595cbad093a4d0bfcc43",
|
||
"lessThan": "ccd3f449052449a917a3e577d8ba0368f43b8f29",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "affected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"drivers/target/target_core_file.c",
|
||
"drivers/target/target_core_iblock.c",
|
||
"drivers/target/target_core_sbc.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "3.8",
|
||
"status": "affected"
|
||
},
|
||
{
|
||
"version": "0",
|
||
"lessThan": "3.8",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.4.294",
|
||
"lessThanOrEqual": "5.4.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.10.238",
|
||
"lessThanOrEqual": "5.10.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.15.182",
|
||
"lessThanOrEqual": "5.15.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.19",
|
||
"lessThanOrEqual": "*",
|
||
"status": "unaffected",
|
||
"versionType": "original_commit_for_fix"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"cpeApplicability": [
|
||
{
|
||
"nodes": [
|
||
{
|
||
"operator": "OR",
|
||
"negate": false,
|
||
"cpeMatch": [
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "3.8",
|
||
"versionEndExcluding": "5.4.294"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "3.8",
|
||
"versionEndExcluding": "5.10.238"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "3.8",
|
||
"versionEndExcluding": "5.15.182"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "3.8",
|
||
"versionEndExcluding": "5.19"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/54e57be2573cf0b8bf650375fd8752987b6c3d3b"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/d8e6a27e9238dd294d6f2f401655f300dca20899"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/4226622647e3e5ac06d3ebc1605b917446157510"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/ccd3f449052449a917a3e577d8ba0368f43b8f29"
|
||
}
|
||
],
|
||
"title": "scsi: target: Fix WRITE_SAME No Data Buffer crash",
|
||
"x_generator": {
|
||
"engine": "bippy-1.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"type": "CWE",
|
||
"cweId": "CWE-476",
|
||
"lang": "en",
|
||
"description": "CWE-476 NULL Pointer Dereference"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2025-05-06T15:06:53.886424Z",
|
||
"id": "CVE-2022-21546",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2025-05-06T15:07:03.602Z"
|
||
}
|
||
},
|
||
{
|
||
"title": "CVE Program Container",
|
||
"references": [
|
||
{
|
||
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||
"shortName": "CVE",
|
||
"dateUpdated": "2025-11-03T17:30:59.924Z"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
"dataVersion": "5.2"
|
||
} |