CVE-2021-28361

Name of the Vulnerable Software and Affected Versions: Storage Performance Development Kit (SPDK) versions prior to 20.01.01

Description: An issue was discovered in the Storage Performance Development Kit (SPDK). If a PDU is sent to the iSCSI target with a zero length (but data is expected), the iSCSI target can crash with a NULL pointer dereference.

Recommendations: For versions prior to 20.01.01, update to version 20.01.01 or later to resolve the issue. As a temporary workaround, consider restricting access to the iSCSI target to minimize the risk of exploitation.