CVE-2021-27363: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability (CVE-2021-27363) was discovered in the Linux kernel through version 5.11.3. The vulnerability allows a kernel pointer leak that can be used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle is available to unprivileged users via the sysfs file system at /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the show_transport_handle function in drivers/scsi/scsi_transport_iscsi.c leaks the handle, which is actually a pointer to an iscsi_transport struct in the kernel module's global variables (NVD, Debian LTS).

The vulnerability exists in the iSCSI subsystem of the Linux kernel where the transport handle is exposed via sysfs to allow the iscsid daemon to access it, but this access is not properly restricted. The vulnerability has a CVSS v3.1 base score of 4.4 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L. The issue was fixed by adding capability checks requiring CAP_SYS_ADMIN privileges to read the transport handle and receive netlink messages (GRIMM Blog, Kernel Commit).

On a system acting as an iSCSI initiator, this vulnerability results in an information leak to local users and makes it easier to exploit CVE-2021-27364. The leaked kernel pointer can be used to bypass Kernel Address Space Layout Randomization (KASLR) as it points to a structure containing multiple function pointers (Debian LTS, GRIMM Blog).

The vulnerability can be exploited by local unprivileged users on systems where the scsi_transport_iscsi kernel module is loaded. This module is automatically loaded when a socket call creates a NETLINK_ISCSI socket. Additionally, at least one iSCSI transport must be registered with the iSCSI subsystem. The ib_iser transport module will be loaded automatically in some configurations when an unprivileged user creates a NETLINK_RDMA socket (GRIMM Blog).

The vulnerability was fixed in Linux kernel version 5.11.3 by adding capability checks requiring CAP_SYS_ADMIN privileges to read the transport handle and receive netlink messages. Various Linux distributions have backported the fix to their supported kernel versions. For example, Debian 9 (Stretch) fixed it in version 4.9.258-1, and RHEL 8 included fixes in their kernel updates. System administrators should apply the appropriate kernel updates for their distribution (Kernel Commit, Debian LTS).