CVE-2013-2850

Heap-based buffer overflow in the iscsi_add_notunderstood_response function
in drivers/target/iscsi/iscsi_target_parameters.c in the iSCSI target
subsystem in the Linux kernel through 3.9.4 allows remote attackers to
cause a denial of service (memory corruption and OOPS) or possibly execute
arbitrary code via a long key that is not properly handled during
construction of an error-response packet.
A reproduction case requires patching open-iscsi to send overly large
keys. Performing discovery in a loop will Oops the remote server.
Attached is a proposed fix, and the patch I used in open-iscsi to trigger
it. Thanks in advance for your cooperation in coordinating a fix for
this issue,

Bugs

• <https://launchpad.net/bugs/1185990&gt;

Notes