UBUNTU-CVE-2013-2850
Dashboard / Vulnerabilities / UBUNTU-CVE-2013-2850
UBUNTU-CVE-2013-2850
Summary:
Details: Heap-based buffer overflow in the iscsi_add_notunderstood_response function in drivers/target/iscsi/iscsi_target_parameters.c in the iSCSI target subsystem in the Linux kernel through 3.9.4 allows remote attackers to cause a denial of service (memory corruption and OOPS) or possibly execute arbitrary code via a long key that is not properly handled during construction of an error-response packet. A reproduction case requires patching open-iscsi to send overly large keys. Performing discovery in a loop will Oops the remote server. Attached is a proposed fix, and the patch I used in open-iscsi to trigger it. Thanks in advance for your cooperation in coordinating a fix for this issue,
References: https://ubuntu.com/security/CVE-2013-2850, https://ubuntu.com/security/notices/USN-1844-1, https://ubuntu.com/security/notices/USN-1845-1, https://ubuntu.com/security/notices/USN-1846-1, https://ubuntu.com/security/notices/USN-1847-1, https://ubuntu.com/security/notices/USN-1849-1, https://ubuntu.com/security/notices/USN-1879-1, https://ubuntu.com/security/notices/USN-1882-1, https://ubuntu.com/security/notices/USN-1883-1, https://www.cve.org/CVERecord?id=CVE-2013-2850
Affected packages
Package
Name: linux
Purl: pkg:deb/ubuntu/[email protected]?arch=source&distro=trusty
Affected ranges
Type: ECOSYSTEM
Events:
