CVE-2022-50350

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists between the login work function and the login thread in the iSCSI target implementation. A malicious initiator sending data immediately after a login PDU can cause the iscsi target sk data ready() callback to schedule login work. If negotiation completes without clearing the LOGIN FLAGS INITIAL PDU flag, login work will repeatedly reschedule itself. Subsequently, if the initiator terminates the connection, a NULL pointer dereference occurs when login work attempts to access a freed socket structure, leading to a kernel crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.