Loading vulnerability…
Out-of-bounds read in Linux kernel iSCSI Netlink processing
CVE-2021-27364 is an out-of-bounds read vulnerability in the Linux kernel iSCSI subsystem, affecting unpatched kernels through 5.11.3. Insufficient validation of user-controlled Netlink lengths and offsets in iscsi_if_recv_msg() and the libiscsi send_pdu processing path allows a local unprivileged user to trigger reads outside an allocated heap buffer. The flaw permits reading up to 8192 bytes at a controllable 32-bit offset from the original buffer, potentially exposing kernel memory or causing a kernel panic.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause a system-wide denial of service through an invalid kernel memory read and may disclose sensitive kernel memory, including addresses or other data useful in subsequent attacks. A kernel-panic proof of concept was demonstrated. Information disclosure is less directly established: the out-of-bounds data is copied into another buffer rather than returned directly to the initiating user. Recovering that data through an attacker-controlled iSCSI target was proposed but not demonstrated. This vulnerability alone does not establish arbitrary code execution or privilege escalation; the demonstrated root exploit involving related iSCSI vulnerabilities used CVE-2021-27365 and CVE-2021-27363.
If you can’t patch tonight, do this now.
Where iSCSI is not required, prevent the libiscsi module from loading using a modprobe install override that substitutes a no-op command. If the module is already loaded, reboot after applying the configuration; active use can prevent unloading. Restrict automatic loading of the iSCSI transport and RDMA modules as additional defense in depth, using platform-supported module-loading controls. Blocking these modules can disrupt systems that depend on iSCSI storage and is not an appropriate workaround for those deployments.
Patch, then assume compromise.
Install a distribution-supported kernel update explicitly fixing CVE-2021-27364 and reboot into the updated kernel. Fixed packages include RHEL 7 kernel 3.10.0-1160.24.1.el7, RHEL 8.1 EUS kernel 4.18.0-147.44.1.el8_1, and RHEL 8.2 EUS kernel 4.18.0-193.51.1.el8_2. Fedora supplied fixes in its 5.10.21 stable kernel updates. On supported Red Hat deployments, a matching kpatch live update can patch the running kernel without a conventional reboot. Select updates for the specific distribution, support stream, architecture, and kernel build rather than relying only on the upstream version number.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.