Loading vulnerability…
Linux kernel iSCSI heap buffer overflow
CVE-2021-27365 is a heap-based buffer overflow in the Linux kernel iSCSI subsystem, affecting unpatched kernels through 5.11.3. Insufficient length validation allows an unprivileged local user to set iSCSI string attributes through Netlink messages to values exceeding PAGE_SIZE. Subsequently reading these attributes through sysfs invokes string-formatting operations, including sprintf() in iscsi_host_get_param(), against a single-page output buffer, causing an overflow. The vulnerability can enable local privilege escalation, kernel-memory disclosure, or denial of service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise kernel confidentiality, integrity, and availability through memory disclosure, heap corruption, privilege escalation to root, or a kernel panic. An unprivileged-to-root exploit was demonstrated on RHEL 8.1 through 8.3 by combining this overflow with CVE-2021-27363 and additional information leakage. That exploit bypassed SMEP, SMAP, and KPTI, but its reliability and applicability depend on the kernel build and allocator hardening.
If you can’t patch tonight, do this now.
Where iSCSI is unnecessary, prevent the libiscsi module and required iSCSI transports from loading, including through automatic module-loading paths. If affected modules are already loaded and cannot safely be unloaded, restart after applying the loading restrictions. Disabling these modules is unsuitable for systems that depend on iSCSI storage. Restricting unprivileged module autoloading provides additional defense in depth. CONFIG_SLAB_FREELIST_HARDENED blocks the demonstrated freelist-corruption exploit technique as written, but does not fix the underlying vulnerability or establish that alternative exploitation is impossible.
Patch, then assume compromise.
Install a distribution-supported kernel update explicitly fixing CVE-2021-27365 and reboot into the patched kernel. Available fixed packages include Fedora kernel 5.10.21, RHEL 7 kernel 3.10.0-1160.24.1.el7, RHEL 8.1 EUS kernel 4.18.0-147.44.1.el8_1, and RHEL 8.2 EUS kernel 4.18.0-193.51.1.el8_2. Use the appropriate current package for the deployed distribution and support stream. Where supported, a vendor-provided kpatch live update matching the running kernel can apply the fix without a conventional reboot.
No validated public exploits yet. Hidden: 2 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.