Bug 667261 – CVE-2011-0001 scsi-target-utils: double-free vulnerability leads to pre-authenticated crash

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 667261 - (CVE-2011-0001) CVE-2011-0001 scsi-target-utils: double-free vulnerability leads to pre-authenticated crash

Summary:	CVE-2011-0001 scsi-target-utils: double-free vulnerability leads to pre-authe...

Status:	CLOSED ERRATA

Aliases:	CVE-2011-0001

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	high Severity high
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	public=20110309,reported=20110104,sou...
Keywords:	Security

Depends On:	667803 667804 667805 667987 667988
Blocks:
	Show dependency tree / graph

Reported:	2011-01-04 19:03 EST by Vincent Danen
Modified:	2015-08-19 05:02 EDT (History)
CC List:	7 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2012-06-21 05:30:21 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
fix the buffer overflow bug before iscsi login (1.34 KB, patch) 2011-01-17 03:42 EST, fujita.tomonori	no flags	Details \| Diff
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2011:0332	normal	SHIPPED_LIVE	Important: scsi-target-utils security update	2011-03-09 13:35:35 EST

Groups: None (edit)

Description Vincent Danen 2011-01-04 19:03:50 EST

Emmanuel Bouillon reported a double-free flaw in scsi-target-utils that could cause the tgtd daemon to crash with memory corruption on receipt of certain network traffic, leading to a denial of service condition.

Acknowledgements:

Red Hat would like to thank Emmanuel Bouillon of NATO C3 Agency for reporting this issue.

Comment 2 Vincent Danen 2011-01-05 12:14:40 EST

Adding upstream; have forwarded to him the details.

Comment 4 fujita.tomonori 2011-01-17 03:42:40 EST

Created attachment 473779 [details]
fix the buffer overflow bug before iscsi login

Comment 5 Josh Bressers 2011-01-17 13:40:01 EST

I can confirm this patch fixes the problem.

Comment 6 Barry Donahue 2011-01-24 14:10:29 EST

Verified for async errata.

Comment 7 Josh Bressers 2011-03-01 10:04:31 EST

Did this fix ever make it upstream? My records show it's still embargoed.

Comment 8 fujita.tomonori 2011-03-03 20:38:35 EST

Can I merge this fix into the public tree? I've been waiting for someone at RedHat to let me know the day when I can make this public.

Comment 9 Vincent Danen 2011-03-03 21:12:49 EST

An unembargo date was never negotiated as far as I can recall.  Perhaps we could set a date for next week, perhaps Wednesday or Thursday (the 9th or 10th)?

Comment 10 fujita.tomonori 2011-03-03 21:18:16 EST

Either is fine by me

Comment 11 manu 2011-03-05 12:08:39 EST

Dear all,
If you ever happen to include an acknowledgement, please also mention my employer: NATO C3 Agency.
B.R. Emmanuel Bouillon

Comment 12 Vincent Danen 2011-03-07 14:10:13 EST

(In reply to comment #11)
> If you ever happen to include an acknowledgement, please also mention my
> employer: NATO C3 Agency.

Thank you for that, we will certainly do so.

In terms of disclosure, let's make it for this coming Wednesday (March 9th) at 14:00 EST.  Does that sound good?

Comment 13 fujita.tomonori 2011-03-07 18:32:49 EST

Sounds good to me. I'll merge the fix into the public git tree after the time.

Comment 14 Vincent Danen 2011-03-08 10:37:29 EST

Perfect.  Thank you!

Comment 15 Vincent Danen 2011-03-09 13:22:50 EST

This is now public, so upstream merges can take place any time now:

http://svn.debian.org/wsvn/kernel/dists/trunk/tgt/debian/patches/CVE-2011-0001

Comment 16 errata-xmlrpc 2011-03-09 13:35:48 EST

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 6

Via RHSA-2011:0332 https://rhn.redhat.com/errata/RHSA-2011-0332.html

Note You need to log in before you can comment on or make changes to this bug.