CVE-2021-47328

What it actually does

Use-after-free in Linux kernel iSCSI where iscsi_conn_teardown frees the conn while error-handling threads still access conn ehwait during resets; fixed by relocating TMF fields to the session so that iscsi_session_teardown guarantees no further device or SCSI-ML access.

Why it matters to the business

Kernel instability or potential code execution in iSCSI storage environments; low exploitation probability and no known campaigns reduce immediate operational risk, yet unpatched systems remain exposed to local or adjacent attackers.

How an attack unfolds

An attacker with access to trigger iSCSI resets races iscsi_conn_teardown against the EH thread so that the freed conn ehwait is dereferenced, enabling use-after-free primitives for memory corruption or privilege escalation.

How to fix it

Upgrade the Linux kernel to a version containing the referenced fix that moves TMF fields from conn to session and relies on iscsi_session_teardown for unbind ordering.

How to confirm the fix worked

Confirm the patch is present by inspecting kernel source for TMF relocation to the session structure and verifying iscsi_remove_session ordering; test iSCSI reset paths for absence of use-after-free warnings.

Typical attack path

1. Obtain ability to initiate iSCSI target resets or session errors
2. Trigger concurrent iscsi_conn_teardown and EH-thread wakeup
3. Access freed ehwait structure before session teardown completes
4. Leverage resulting use-after-free for kernel memory corruption

How to detect it

Search kernel logs and crash dumps for messages referencing iscsi_conn_teardown, ehwait, or use-after-free during iSCSI session teardown; correlate with unexpected iSCSI target resets.

What your security team should do

• Prioritize kernel updates on all systems using iSCSI initiators or targets
• Review iSCSI configurations for unnecessary exposure to untrusted initiators
• Monitor kernel logs for iscsi-related use-after-free or panic signatures
• Apply defense-in-depth with kernel hardening features such as KASAN or hardened allocators where feasible