CVE-2021-27363

What it actually does

The flaw leaks a kernel pointer to the iscsi_transport structure through the world-readable sysfs file /sys/class/iscsi_transport/$TRANSPORT_NAME/handle, allowing local unprivileged users to read the address of a kernel module global variable.

Why it matters to the business

Attackers can obtain kernel memory layout information that assists in bypassing address-space layout randomization on Linux systems using iSCSI, raising the likelihood of successful local privilege-escalation attacks and potential full system compromise.

How an attack unfolds

An attacker with local access reads the exposed sysfs handle to obtain the kernel pointer, then uses the leaked address to defeat KASLR and craft a follow-on kernel exploit that targets structures near the leaked iscsi_transport object.

How to fix it

Upgrade the Linux kernel to the version containing commit 688e8128b7a92df982709a4137ea4588d16f24aa or later; rebuild and reboot all affected systems; disable iSCSI transports if unused.

How to confirm the fix worked

Confirm the running kernel contains commit 688e8128b7a92df982709a4137ea4588d16f24aa; verify that reading the handle file no longer returns a kernel address; test with a non-privileged user to ensure the pointer is no longer visible.

Typical attack path

1. Identify a system exposing iSCSI transport entries under /sys/class/iscsi_transport/
2. Read the handle file for any registered transport to obtain the kernel pointer
3. Combine the leaked address with other kernel vulnerabilities or gadgets to bypass KASLR
4. Execute a privilege-escalation payload that references the discovered kernel memory layout

How to detect it

Search system logs and audit trails for repeated or unexpected access to /sys/class/iscsi_transport/*/handle files; correlate with subsequent kernel exploit attempts or unusual process behavior after such reads.

• /sys/class/iscsi_transport/*/handle
• show_transport_handle

What your security team should do

• Apply the kernel update containing commit 688e8128b7a92df982709a4137ea4588d16f24aa on all Linux hosts within the next 30 days
• Audit iSCSI usage and disable the subsystem where not required
• Add monitoring for unusual reads of iscsi_transport sysfs entries
• Review and harden kernel configurations to reduce information leaks