CVE-2021-47427

In the Linux kernel, the following vulnerability has been resolved:

scsi: iscsi: Fix iscsi_task use after free

Commit d39df158518c (scsi: iscsi: Have abort handler get ref to conn) added iscsi_get_conn()/iscsi_put_conn() calls during abort handling but then also changed the handling of the case where we detect an already completed task where we now end up doing a goto to the common put/cleanup code. This results in a iscsi_task use after free, because the common cleanup code will do a put on the iscsi_task.

This reverts the goto and moves the iscsi_get_conn() to after weve checked if the iscsi_task is valid.

Weakness

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

Affected Software

Potential Mitigations

References

• https://git.kernel.org/stable/c/1642f51ac0d4f2b55d5748094c49ff8f7191b93c
• https://git.kernel.org/stable/c/258aad75c62146453d03028a44f2f1590d58e1f6
• https://git.kernel.org/stable/c/1642f51ac0d4f2b55d5748094c49ff8f7191b93c
• https://git.kernel.org/stable/c/258aad75c62146453d03028a44f2f1590d58e1f6