CVE-2023-2162

What it actually does

Use-after-free in iscsi_sw_tcp_session_create allows reading from freed kernel memory, resulting in leakage of internal kernel structures and addresses.

Why it matters to the business

Local attackers on affected Linux systems can obtain sensitive kernel information that may facilitate additional attacks; the vulnerability affects downstream projects using the vulnerable kernel code paths and has been publicly known for over three years with no observed exploitation.

How an attack unfolds

An attacker with local user privileges supplies crafted parameters to the iSCSI TCP session creation routine, triggering the use-after-free condition and reading residual kernel data from the freed object.

How to fix it

Apply the kernel fix present in commit 7d4dab60352079953b7be120afe9bd14983ae3bc; for the listed affected repositories update cloudexplorer-dev/cloudexplorer-lite and 1panel-dev/cloudexplorer to the same commit or later.

How to confirm the fix worked

Confirm the presence of commit 7d4dab60352079953b7be120afe9bd14983ae3bc in the drivers/scsi/iscsi_tcp.c file or verify the running kernel contains the corrected session-creation logic.

Typical attack path

1. Obtain local shell or user context on a vulnerable host
2. Trigger iSCSI TCP session creation via userspace tooling or direct syscall
3. Read leaked kernel pointers or structures from the freed memory region
4. Use leaked data to bypass KASLR or inform subsequent kernel exploits

How to detect it

Review kernel logs for iSCSI TCP session creation errors or warnings around the time of suspected activity; examine process execution involving iscsiadm or similar tools for anomalous local usage.

What your security team should do

• Patch affected kernels and rebuild any custom images containing the vulnerable driver
• Audit systems for local iSCSI usage and restrict unnecessary privileges
• Monitor EPSS and exploit maturity indicators; current values remain low