In the Linux kernel, the following vulnerability has been resolved:
scsi: target: core: Add TMF to tmr_list handling
An abort that is responded to by iSCSI itself is added to tmrlist but does not go to target core. A LUNRESET that goes through tmr_list takes a refcounter on the abort and waits for completion. However, the abort will be never complete because it was not started in target core.
Unable to locate ITT: 0x05000000 on CID: 0 Unable to locate RefTaskTag: 0x05000000 on CID: 0. waitfortasks: Stopping tmf LUNRESET with tag 0x0 reftasktag 0x0 istate 34 tstate ISTATEPROCESSING refcnt 2 transportstate active,stop,fabricstop wait for tasks: tmf LUNRESET with tag 0x0 reftasktag 0x0 istate 34 tstate ISTATEPROCESSING refcnt 2 transportstate active,stop,fabricstop ... INFO: task kworker/0:2:49 blocked for more than 491 seconds. task:kworker/0:2 state:D stack: 0 pid: 49 ppid: 2 flags:0x00000800 Workqueue: events targettmrwork [targetcoremod] Call Trace: _switchto+0x2c4/0x470 schedule+0x314/0x1730 schedule+0x64/0x130 scheduletimeout+0x168/0x430 waitforcompletion+0x140/0x270 targetputcmdandwait+0x64/0xb0 [targetcoremod] coretmrlunreset+0x30/0xa0 [targetcoremod] targettmrwork+0xc8/0x1b0 [targetcoremod] processonework+0x2d4/0x5d0 workerthread+0x78/0x6c0
To fix this, only add abort to tmr_list if it will be handled by target core.
[
{
"id": "CVE-2024-26845-328aec73",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"112357450442602072671880889624863035406",
"313438226290991255628666521996206779745",
"82119804390729110479511460128731878006",
"314477817513712797546303117421335106540",
"302476028623747362399868712582573721486",
"104395615543500535444668225669811941155",
"301975123374302286811355834703780970606",
"115077598059573814096235822743062113531",
"318618698051065069566958431633120339727",
"287027266545651217419161481382984389086"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36bc5040c863b44af06094b22f1e50059227b9cb",
"target": {
"file": "drivers/target/target_core_device.c"
}
},
{
"id": "CVE-2024-26845-3a668a6b",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"159525859804647180238937813550471845409",
"70039786358243028283305758681964548526",
"29415134811233657020568545669776698568"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36bc5040c863b44af06094b22f1e50059227b9cb",
"target": {
"file": "drivers/target/target_core_transport.c"
}
},
{
"id": "CVE-2024-26845-42cb505d",
"signature_version": "v1",
"digest": {
"length": 1037.0,
"function_hash": "327410987145733615408752128640648850140"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9849b67b4402a12eb35eadc9306c1ef9847d53d",
"target": {
"file": "drivers/target/target_core_device.c",
"function": "transport_lookup_tmr_lun"
}
},
{
"id": "CVE-2024-26845-795b2b5d",
"signature_version": "v1",
"digest": {
"length": 1024.0,
"function_hash": "6731718816224690898829428747622048270"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36bc5040c863b44af06094b22f1e50059227b9cb",
"target": {
"file": "drivers/target/target_core_device.c",
"function": "transport_lookup_tmr_lun"
}
},
{
"id": "CVE-2024-26845-a83ef464",
"signature_version": "v1",
"digest": {
"length": 640.0,
"function_hash": "46276004030385778522662252180815056189"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9849b67b4402a12eb35eadc9306c1ef9847d53d",
"target": {
"file": "drivers/target/target_core_transport.c",
"function": "transport_generic_handle_tmr"
}
},
{
"id": "CVE-2024-26845-dc8784d4",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"159525859804647180238937813550471845409",
"70039786358243028283305758681964548526",
"29415134811233657020568545669776698568"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9849b67b4402a12eb35eadc9306c1ef9847d53d",
"target": {
"file": "drivers/target/target_core_transport.c"
}
},
{
"id": "CVE-2024-26845-e472c5dd",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"112357450442602072671880889624863035406",
"313438226290991255628666521996206779745",
"82119804390729110479511460128731878006",
"314477817513712797546303117421335106540",
"302476028623747362399868712582573721486",
"104395615543500535444668225669811941155",
"301975123374302286811355834703780970606",
"115077598059573814096235822743062113531",
"318618698051065069566958431633120339727",
"287027266545651217419161481382984389086"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9849b67b4402a12eb35eadc9306c1ef9847d53d",
"target": {
"file": "drivers/target/target_core_device.c"
}
},
{
"id": "CVE-2024-26845-f63c0ed3",
"signature_version": "v1",
"digest": {
"length": 640.0,
"function_hash": "46276004030385778522662252180815056189"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36bc5040c863b44af06094b22f1e50059227b9cb",
"target": {
"file": "drivers/target/target_core_transport.c",
"function": "transport_generic_handle_tmr"
}
}
]