CVE-2024-26845
Linux Kernel iSCSI Target Core Dangling Abort Reference Count
Description
In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Add TMF to tmr_list handling An abort that is responded to by iSCSI itself is added to tmr_list but does not go to target core. A LUN_RESET that goes through tmr_list takes a refcounter on the abort and waits for completion. However, the abort will be never complete because it was not started in target core. Unable to locate ITT: 0x05000000 on CID: 0 Unable to locate RefTaskTag: 0x05000000 on CID: 0. wait_for_tasks: Stopping tmf LUN_RESET with tag 0x0 ref_task_tag 0x0 i_state 34 t_state ISTATE_PROCESSING refcnt 2 transport_state active,stop,fabric_stop wait for tasks: tmf LUN_RESET with tag 0x0 ref_task_tag 0x0 i_state 34 t_state ISTATE_PROCESSING refcnt 2 transport_state active,stop,fabric_stop ... INFO: task kworker/0:2:49 blocked for more than 491 seconds. task:kworker/0:2 state:D stack: 0 pid: 49 ppid: 2 flags:0x00000800 Workqueue: events target_tmr_work [target_core_mod] Call Trace: __switch_to+0x2c4/0x470 _schedule+0x314/0x1730 schedule+0x64/0x130 schedule_timeout+0x168/0x430 wait_for_completion+0x140/0x270 target_put_cmd_and_wait+0x64/0xb0 [target_core_mod] core_tmr_lun_reset+0x30/0xa0 [target_core_mod] target_tmr_work+0xc8/0x1b0 [target_core_mod] process_one_work+0x2d4/0x5d0 worker_thread+0x78/0x6c0 To fix this, only add abort to tmr_list if it will be handled by target core.
INFO
Published Date :
April 17, 2024, 10:15 a.m.
Last Modified :
April 2, 2025, 1:17 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
3.6
Exploitability Score :
1.8
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-26845.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-26845 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2024-26845 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Apr. 02, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE NVD-CWE-noinfo Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.80 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.150 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20 up to (excluding) 5.4.270 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.7.7 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.19 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.211 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions up to (excluding) 4.19.308 Added CPE Configuration OR *cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Added Reference Type CVE: https://git.kernel.org/stable/c/11f3fe5001ed05721e641f0ecaa7a73b7deb245d Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/11f3fe5001ed05721e641f0ecaa7a73b7deb245d Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/168ed59170de1fd7274080fe102216162d6826cf Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/168ed59170de1fd7274080fe102216162d6826cf Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/36bc5040c863b44af06094b22f1e50059227b9cb Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/36bc5040c863b44af06094b22f1e50059227b9cb Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/425a571a7e6fc389954cf2564e1edbba3740e171 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/425a571a7e6fc389954cf2564e1edbba3740e171 Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/83ab68168a3d990d5ff39ab030ad5754cbbccb25 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/83ab68168a3d990d5ff39ab030ad5754cbbccb25 Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/a9849b67b4402a12eb35eadc9306c1ef9847d53d Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/a9849b67b4402a12eb35eadc9306c1ef9847d53d Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/bd508f96b5fef96d8a0ce9cbb211d82bcfc2341f Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/bd508f96b5fef96d8a0ce9cbb211d82bcfc2341f Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/e717bd412001495f17400bfc09f606f1b594ef5a Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/e717bd412001495f17400bfc09f606f1b594ef5a Types: Patch Added Reference Type CVE: https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Types: Mailing List Added Reference Type CVE: https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html Types: Mailing List -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/11f3fe5001ed05721e641f0ecaa7a73b7deb245d Added Reference https://git.kernel.org/stable/c/168ed59170de1fd7274080fe102216162d6826cf Added Reference https://git.kernel.org/stable/c/36bc5040c863b44af06094b22f1e50059227b9cb Added Reference https://git.kernel.org/stable/c/425a571a7e6fc389954cf2564e1edbba3740e171 Added Reference https://git.kernel.org/stable/c/83ab68168a3d990d5ff39ab030ad5754cbbccb25 Added Reference https://git.kernel.org/stable/c/a9849b67b4402a12eb35eadc9306c1ef9847d53d Added Reference https://git.kernel.org/stable/c/bd508f96b5fef96d8a0ce9cbb211d82bcfc2341f Added Reference https://git.kernel.org/stable/c/e717bd412001495f17400bfc09f606f1b594ef5a Added Reference https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Added Reference https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Nov. 05, 2024
Action Type Old Value New Value Removed Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Removed Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 27, 2024
Action Type Old Value New Value Added Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html [No types assigned] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 25, 2024
Action Type Old Value New Value Added Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html [No types assigned] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 29, 2024
Action Type Old Value New Value -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 14, 2024
Action Type Old Value New Value -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 17, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Add TMF to tmr_list handling An abort that is responded to by iSCSI itself is added to tmr_list but does not go to target core. A LUN_RESET that goes through tmr_list takes a refcounter on the abort and waits for completion. However, the abort will be never complete because it was not started in target core. Unable to locate ITT: 0x05000000 on CID: 0 Unable to locate RefTaskTag: 0x05000000 on CID: 0. wait_for_tasks: Stopping tmf LUN_RESET with tag 0x0 ref_task_tag 0x0 i_state 34 t_state ISTATE_PROCESSING refcnt 2 transport_state active,stop,fabric_stop wait for tasks: tmf LUN_RESET with tag 0x0 ref_task_tag 0x0 i_state 34 t_state ISTATE_PROCESSING refcnt 2 transport_state active,stop,fabric_stop ... INFO: task kworker/0:2:49 blocked for more than 491 seconds. task:kworker/0:2 state:D stack: 0 pid: 49 ppid: 2 flags:0x00000800 Workqueue: events target_tmr_work [target_core_mod] Call Trace: __switch_to+0x2c4/0x470 _schedule+0x314/0x1730 schedule+0x64/0x130 schedule_timeout+0x168/0x430 wait_for_completion+0x140/0x270 target_put_cmd_and_wait+0x64/0xb0 [target_core_mod] core_tmr_lun_reset+0x30/0xa0 [target_core_mod] target_tmr_work+0xc8/0x1b0 [target_core_mod] process_one_work+0x2d4/0x5d0 worker_thread+0x78/0x6c0 To fix this, only add abort to tmr_list if it will be handled by target core. Added Reference kernel.org https://git.kernel.org/stable/c/425a571a7e6fc389954cf2564e1edbba3740e171 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/11f3fe5001ed05721e641f0ecaa7a73b7deb245d [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/168ed59170de1fd7274080fe102216162d6826cf [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/a9849b67b4402a12eb35eadc9306c1ef9847d53d [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/e717bd412001495f17400bfc09f606f1b594ef5a [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/36bc5040c863b44af06094b22f1e50059227b9cb [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/bd508f96b5fef96d8a0ce9cbb211d82bcfc2341f [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/83ab68168a3d990d5ff39ab030ad5754cbbccb25 [No types assigned]
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-26845 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-26845
weaknesses.