Cloudanix VulnDB

CVE-2023-54184

None

CVSS

—

EPSS

0.6%

Published

Dec 30, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in Linux storage target code can crash the system when handling certain network storage sessions, leading to unexpected downtime.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in iSCSI target session cleanup where recovery commands are freed after the session, causing NULL pointer dereference during command release in sbitmap_queue_clear.

Why it matters to the business

Kernel crashes or panics on Linux systems running iSCSI targets can interrupt storage services, cause downtime, and require reboots or maintenance windows, especially in environments with high iSCSI session churn.

How an attack unfolds

An attacker establishes an iSCSI session, triggers the Time2Retain timer expiration through connection issues or crafted traffic, then relies on the incorrect cleanup order during iscsit_close_session to dereference freed memory.

How to fix it

Update the Linux kernel to a version containing commit 89f5055f9b0b57c7e7f02e32df95ef401f809b71 or later; apply vendor backports for stable branches if available.

How to confirm the fix worked

Verify the presence of commit 89f5055f9b0b57c7e7f02e32df95ef401f809b71 in the kernel source or confirm via kernel version strings and module symbols that the iscsit_free_connection_recovery_entries ordering change is present.

Typical attack path

  1. Establish iSCSI session to target
  2. Induce session recovery or timeout conditions
  3. Force Time2Retain timer expiration
  4. Trigger iscsit_close_session path
  5. Cause use-after-free during command freeing

How to detect it

Search kernel logs for the exact BUG message 'BUG: kernel NULL pointer dereference' combined with the call trace containing iscsit_free_connection_recovery_entries and iscsit_close_session; look for Time2Retain timer expiration messages preceding crashes.

  • Time2Retain timer expired for SID
  • BUG: kernel NULL pointer dereference, address: 0000000000000140
  • iscsit_free_connection_recovery_entries
  • iscsit_close_session

What your security team should do

  • Prioritize kernel updates on all systems exposing iSCSI targets
  • Monitor for kernel oops involving target_core_mod and iscsi_target_mod
  • Review iSCSI configurations for unnecessary exposure
  • Test updates in staging before production rollout

The record

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsit: Free cmds before session free Commands from recovery entries are freed after session has been closed. That leads to use-after-free at command free or NPE with such call trace: Time2Retain timer expired for SID: 1, cleaning up iSCSI session. BUG: kernel NULL pointer dereference, address: 0000000000000140 RIP: 0010:sbitmap_queue_clear+0x3a/0xa0 Call Trace: target_release_cmd_kref+0xd1/0x1f0 [target_core_mod] transport_generic_free_cmd+0xd1/0x180 [target_core_mod] iscsit_free_cmd+0x53/0xd0 [iscsi_target_mod] iscsit_free_connection_recovery_entries+0x29d/0x320 [iscsi_target_mod] iscsit_close_session+0x13a/0x140 [iscsi_target_mod] iscsit_check_post_dataout+0x440/0x440 [iscsi_target_mod] call_timer_fn+0x24/0x140 Move cleanup of recovery enrties to before session freeing.

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 0 5.4.244
Linux Kernel 3.12.0 5.4.244

Related vulnerabilities