CVE-2017-17840— Open-iSCSI 缓冲区错误漏洞

N/A

An issue was discovered in Open-iSCSI through 2.0.875. A local attacker can cause the iscsiuio server to abort or potentially execute code by sending messages with incorrect lengths, which (due to lack of checking) can lead to buffer overflows, and result in aborts (with overflow checking enabled) or code execution. The process_iscsid_broadcast function in iscsiuio/src/unix/iscsid_ipc.c does not validate the payload length before a write operation.

N/A

N/A

Open-iSCSI 缓冲区错误漏洞

Open-iSCSI是一款基于Linux平台的开源iSCSI（小型计算机系统接口）工具。 Open-iSCSI 2.0.875及之前的版本中的iscsiuio/src/unix/iscsid_ipc.c文件的‘process_iscsid_broadcast’函数存在缓冲区溢出漏洞，该漏洞源于程序在执行写入操作之前没有验证载荷的长度。本地攻击者可通过发送带有错误长度的消息利用该漏洞造成拒绝服务或执行代码。

N/A

N/A