CVE-2021-47290

What it actually does

Null pointer dereference in target_complete_cmd() triggered during completion of EXTENDED COPY PT commands because xcopy_pt_tpg lacks a se_tpg_wwn pointer when CPU affinity is enabled.

Why it matters to the business

Systems running vulnerable Linux kernels with LIO SCSI target support can experience kernel panics and denial of service when handling XCOPY requests, disrupting storage services and requiring reboots.

How an attack unfolds

An attacker sends a SCSI EXTENDED COPY command to a vulnerable LIO target; the command dispatches read/write operations through the global xcopy_pt_tpg, and on completion target_complete_cmd() dereferences the missing se_tpg_wwn pointer, crashing the kernel.

How to fix it

Upgrade the Linux kernel to a version containing the fix that checks for NULL se_tpg_wwn and falls back to se_cmd->cpuid for work queuing.

How to confirm the fix worked

Verify the kernel no longer panics when running libiscsi SCSI.ExtendedCopy.Simple or equivalent XCOPY workloads; confirm presence of the corrected target_complete_cmd logic in source or running kernel.

Typical attack path

1. Establish iSCSI or SCSI session to LIO target
2. Issue SCSI ExtendedCopy command
3. Trigger target_xcopy_do_work and subsequent PT command completion
4. Execute target_complete_cmd() with NULL se_tpg_wwn

How to detect it

Search kernel logs and dmesg for BUG: kernel NULL pointer dereference with RIP in target_complete_cmd and stack traces containing target_xcopy_do_work or fd_execute_rw.

What your security team should do

• Apply the upstream fix or distribution kernel update as soon as available
• Restrict untrusted initiators from issuing EXTENDED COPY commands via ACLs or target configuration
• Monitor kernel logs for NULL pointer dereference oops in target_core_mod