CVE-2026-44944: 
CBL Mariner 취약성 분석 및 완화

CVE-2026-44944 is an Incorrect Authorization vulnerability in open-iscsi that allows unprivileged local users to interact with the iscsiuio control socket without proper access controls. The flaw was discovered by Keith at Linneman Labs and publicly disclosed on July 29, 2026. It affects open-iscsi versions up to and including commit 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e (the fix commit itself). The vulnerability carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 8.5 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-863 (Incorrect Authorization) and CWE-1220 (Insufficient Granularity of Access Control). In the vulnerable code path within iscsiuio/src/unix/iscsid_ipc.c, the mgmt_peeruser() function was called with the listening socket file descriptor (iscsid_opts.fd) rather than the accepted connection socket (s2), meaning the credential check was performed against the wrong file descriptor and could be bypassed by an unprivileged local user. The fix corrects this by passing s2 to mgmt_peeruser() and changing a break to continue so that rejected connections are properly handled without terminating the loop (open-iscsi commit). No public proof-of-concept exploit code has been identified at this time (Github Advisory).

Successful exploitation allows an unprivileged local user to send arbitrary commands to the iscsiuio control socket, which is normally restricted to root. This can result in high-impact confidentiality, integrity, and availability consequences — including reading sensitive iSCSI configuration data, modifying storage subsystem settings, and crashing the iscsiuio service. Systems using iSCSI for network-attached storage are particularly at risk, as manipulation of the iSCSI subsystem could disrupt storage connectivity or facilitate further privilege escalation (Github Advisory, Red Hat Bugzilla).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept at this time. The NVD SSVC assessment classifies exploitation as "none" and the attack is not automatable, requiring low-privilege local access to the target system. The EPSS score is approximately 0.093% (1st percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, Red Hat Bugzilla).

1. Gain local access: Obtain a low-privilege shell on a Linux system running a vulnerable version of open-iscsi (any version up to commit 668ca1df).
2. Confirm iscsiuio is running: Check for the iscsiuio process and the existence of its control socket (typically a Unix domain socket) using ps aux | grep iscsiuio and ls -la /var/run/ or similar paths.
3. Connect to the control socket: Because the credential check is performed against the wrong file descriptor, connect to the iscsiuio control socket directly (e.g., using a custom client or socat) without root privileges.
4. Send control commands: Issue commands over the socket that would normally require root authorization, such as reading iSCSI session configuration, modifying parameters, or triggering service disruption.
5. Achieve objective: Depending on attacker goals, exfiltrate sensitive iSCSI configuration data, alter storage connectivity settings, or crash the iscsiuio daemon (open-iscsi commit, Github Advisory).

• Logs: Unexpected or repeated connections to the iscsiuio control socket from non-root processes; log entries such as Access error: non-administrative connection rejected in iscsiuio logs (post-patch systems) may indicate attempted exploitation.
• Process: Unprivileged processes (non-root UID) communicating with the iscsiuio Unix domain socket, observable via lsof or ss -xp.
• File System: Unusual modifications to iSCSI configuration files in /var/lib/iscsi/ or /etc/iscsi/ by non-root users.
• Network: Unexpected changes to iSCSI session targets or portal configurations that do not correspond to authorized administrative actions.

Apply the patch introduced in commit 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e in the open-iscsi repository, which corrects the file descriptor used in the mgmt_peeruser() credential check. Linux distribution maintainers (including Red Hat/Fedora) are tracking this via their respective advisories. As a workaround until patching is complete, restrict access to the iscsiuio control socket using filesystem permissions or access control lists (ACLs) to limit socket access to root only. Audit local user accounts on systems running open-iscsi and minimize the number of users with local shell access (Github Advisory, Red Hat Bugzilla, open-iscsi commit).