CVE-2023-54184

Vulnerability

CVE-2023-54184 is a use-after-free vulnerability in the Linux kernel's iSCSI target subsystem (iscsi_target_mod). The root cause is that commands associated with connection recovery entries are freed *after* the iSCSI session has been closed, leading to a race condition where the session cleanup code may attempt to access already-freed memory or cause a NULL pointer dereference.

Exploitation

The issue is triggered when the Time2Retain timer expires for an iSCSI session, initiating session teardown. The call trace shows a NULL pointer dereference in sbitmap_queue_clear followed by functions in the target core and iSCSI target modules. An attacker with the ability to cause session disconnection or manipulate recovery entries on an active iSCSI target could trigger this race condition.

Impact

A successful exploit can cause a denial of service via kernel crash (oops). In the worst case, the use-after-free may be leveraged for arbitrary code execution, though the provided description focuses on the NULL pointer dereference and crash scenario.

Mitigation

The fix, applied in stable kernel commits, moves the cleanup of recovery entries to before the session is freed [1][2]. All Linux distributions that include the vulnerable code should apply the corresponding stable kernel update.