CVE-2024-26845

What it actually does

The vulnerability is a deadlock in Linux kernel SCSI target core where an iSCSI-handled abort added to tmr_list causes a subsequent LUN_RESET TMF to block indefinitely waiting for completion of a task that target core never started, resulting in hung kworker threads and system unresponsiveness.

Why it matters to the business

Systems using Linux kernel iSCSI target functionality may experience prolonged or indefinite hangs during storage reset operations, leading to service disruption and requiring manual intervention or reboot in affected environments.

How an attack unfolds

An attacker with local access issues iSCSI commands that cause an abort to be added to tmr_list without target core processing; a follow-on LUN_RESET then takes a reference and waits forever, blocking the target_tmr_work queue and producing the observed task hang symptoms.

How to fix it

Upgrade the Linux kernel to a version containing commit 11f3fe5001ed05721e641f0ecaa7a73b7deb245d or later; apply the fix that ensures aborts are only added to tmr_list when they will be processed by target core.

How to confirm the fix worked

Verify the running kernel contains the referenced commit or is newer than the vulnerable versions; reproduce the abort + LUN_RESET sequence in a test environment and confirm the workqueue no longer blocks.

Typical attack path

1. Obtain local user privileges on a Linux system running the vulnerable kernel with iSCSI target enabled
2. Send crafted iSCSI abort commands that are handled by the fabric layer
3. Trigger a LUN_RESET TMF that references the pending abort
4. Observe indefinite wait in target_tmr_work causing kernel task blockage

How to detect it

Search kernel logs and dmesg for strings indicating failed ITT lookup during iSCSI aborts, blocked target_tmr_work threads, and repeated 'wait for tasks' messages related to LUN_RESET; correlate with high uptime of kworker processes in state D.

• Unable to locate ITT: 0x05000000 on CID: 0
• Unable to locate RefTaskTag: 0x05000000 on CID: 0
• wait_for_tasks: Stopping tmf LUN_RESET with tag 0x0 ref_task_tag 0x0
• INFO: task kworker/0:2 blocked for more than 491 seconds
• Workqueue: events target_tmr_work [target_core_mod]

What your security team should do

• Apply the kernel patch containing commit 11f3fe5001ed05721e641f0ecaa7a73b7deb245d as highest priority on all systems exposing iSCSI targets
• Monitor kernel logs for 'Unable to locate ITT' and long-blocked kworker messages indicating exposure
• Restrict local access to systems running iSCSI target until patched