Loading vulnerability…
Linux kernel iSCSI transport handle kernel pointer disclosure
CVE-2021-27363 is an information-disclosure vulnerability in the Linux kernel iSCSI subsystem affecting unpatched kernels through 5.11.3. When an iSCSI transport is registered, show_transport_handle() exposes its transport handle through a sysfs attribute readable by unprivileged local users. The handle is actually a kernel pointer to an iscsi_transport structure stored in the transport module's global variables. Disclosure reveals the location of a structure containing function pointers, weakening address-space randomization and facilitating exploitation of other iSCSI vulnerabilities.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unprivileged local user can obtain an iSCSI transport structure's kernel address. The disclosure can support kernel address-space randomization bypass and exploitation chains; it was combined with CVE-2021-27365 in a demonstrated local privilege-escalation exploit on RHEL 8.1 through 8.3. Combined with unrestricted iSCSI netlink command access associated with CVE-2021-27364, the exposed handle can also enable arbitrary termination of iSCSI sessions, disrupting storage connectivity. This pointer disclosure alone does not establish arbitrary code execution or root access.
If you can’t patch tonight, do this now.
On systems that do not require iSCSI, prevent libiscsi from loading using a modprobe install override such as 'install libiscsi /bin/true'. Reboot if the affected modules are already loaded and cannot safely be unloaded. Restricting automatic loading of iSCSI and RDMA transport modules provides additional defense in depth where supported. Disabling these modules can disrupt required iSCSI storage functionality and is unsuitable for systems that depend on it.
Patch, then assume compromise.
Install the distribution-supported kernel or kernel-rt update addressing CVE-2021-27363 and reboot into the patched kernel. The upstream fix is commit 688e8128b7a92df982709a4137ea4588d16f24aa; Fedora delivered the fix in kernel 5.10.21. Fixed Red Hat builds include 3.10.0-1160.24.1.el7 for RHEL 7, 4.18.0-147.44.1.el8_1 for RHEL 8.1 EUS, and 4.18.0-193.51.1.el8_2 for RHEL 8.2 EUS. Use the update applicable to the installed product and support stream, or a later supported release containing the fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.