Every CVE Search/ Get API key

CVE-2024-45751

tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand...

5.9 MediumFix available

tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.55%Up 0.5 points since Sep 6, 2024
90%50%10%1%

What each source reports

CVE List Score used 5.9

tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical.

Record
CVE-2024-45751
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-338
Updated
2026-11-02
EUVDEUVD-2024-41704 5.9

tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical.

Record
EUVD-2024-41704
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-cwq5-xwx7-85wm 5.9

tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand...

tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical.

Record
GHSA-cwq5-xwx7-85wm
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-338
Updated
2026-11-02
NVD 5.9

tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical.

Record
CVE-2024-45751
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-338
Updated
2026-11-02
OSV 5.9

tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical.

Record
CVE-2024-45751
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2024-45751 5.9

tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical.

Record
DEBIAN-CVE-2024-45751
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
Show 7 moreShow less
OSVOESA-2024-2156 7.5

scsi-target-utils security update

The SCSI target package contains the daemon and tools to setup a SCSI targets. Currently, software iSCSI targets are supported.

Security Fix(es):

tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical.(CVE-2024-45751)

Record
OESA-2024-2156
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2024-45751 5.9

tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical.

Record
UBUNTU-CVE-2024-45751
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVMGASA-2024-0304 No score

Updated tgt packages fix security vulnerability

tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical. (CVE-2024-45751)

Record
MGASA-2024-0304
Updated
2026-11-02
OSVSUSE-SU-2025:02591-1 No score

Security update for tgt

This update for tgt fixes the following issues:

  • CVE-2024-45751: Fixed CHAP authentication bypass in user-space Linux target framework (bsc#1230360)
Record
SUSE-SU-2025:02591-1
Updated
2026-11-02
OSVSUSE-SU-2025:02740-1 No score

Security update for tgt

This update for tgt fixes the following issues:

  • CVE-2024-45751: Fixed CHAP authentication bypass in user-space Linux target framework (bsc#1230360)
Record
SUSE-SU-2025:02740-1
Updated
2026-11-02
OSVUSN-7024-1 No score

tgt vulnerability

It was discovered that tgt attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical.

Record
USN-7024-1
Updated
2026-11-02
OSVUSN-8325-1 No score

tgt vulnerability

It was discovered that tgt incorrectly tried to achieve entropy by calling rand without srand. An attacker could possibly use this issue to make tgt generate an identical sequence of challenges, resulting in authentication bypass.

Record
USN-8325-1
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
tgt
Debian:12
 before 1:1.0.85-1+deb12u1, plus listed versions
1:1.0.85-1
1:1.0.85-1+deb12u1
tgt
Debian:13
 before 1:1.0.85-1.3
1:1.0.85-1.3
tgt
Debian:14
 before 1:1.0.85-1.3
1:1.0.85-1.3
tgt
Debian:11
 before 1:1.0.80-1+deb11u1, plus listed versions
1:1.0.80-1
1:1.0.80-1+deb11u1
tgt
Mageia:9
 before 1.0.85-1.1.mga9
1.0.85-1.1.mga9
scsi-target-utils
openEuler:20.03-LTS-SP4
 before 1.0.79-5.oe2003sp4
1.0.79-5.oe2003sp4
scsi-target-utils
openEuler:22.03-LTS-SP1
 before 1.0.79-6.oe2203sp1
1.0.79-6.oe2203sp1
scsi-target-utils
openEuler:24.03-LTS
 before 1.0.91-2.oe2403
1.0.91-2.oe2403
scsi-target-utils
openEuler:22.03-LTS-SP4
 before 1.0.79-6.oe2203sp4
1.0.79-6.oe2203sp4
scsi-target-utils
openEuler:22.03-LTS-SP3
 before 1.0.79-6.oe2203sp3
1.0.79-6.oe2203sp3
Show 10 moreShow less
Affected packages
PackageAffectedFixed
tgt
SUSE:Linux Enterprise Module for Basesystem 15 SP6
 before 1.0.85-150600.10.3.1
1.0.85-150600.10.3.1
tgt
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 1.0.85-150600.10.3.1
1.0.85-150600.10.3.1
tgt
openSUSE:Leap 15.6
 before 1.0.85-150600.10.3.1
1.0.85-150600.10.3.1
tgt
Ubuntu:Pro:14.04:LTS
 before 1:1.0.43-0ubuntu4.1~14.04.3+esm1, plus listed versions
1:1.0.38-0ubuntu11:1.0.41-0ubuntu11:1.0.43-0ubuntu11:1.0.43-0ubuntu21:1.0.43-0ubuntu41:1.0.43-0ubuntu4.1~14.04.11:1.0.43-0ubuntu4.1~14.04.21:1.0.43-0ubuntu4.1~14.04.3
1:1.0.43-0ubuntu4.1~14.04.3+esm1
tgt
Ubuntu:Pro:16.04:LTS
 before 1:1.0.63-1ubuntu1.1+esm1, plus listed versions
1:1.0.57-1ubuntu21:1.0.62-1ubuntu11:1.0.62-1ubuntu21:1.0.63-1ubuntu11:1.0.63-1ubuntu1.1
1:1.0.63-1ubuntu1.1+esm1
iscsitarget
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.4.20.3+svn502-2ubuntu21.4.20.3+svn502-2ubuntu41.4.20.3+svn502-2ubuntu4.11.4.20.3+svn502-2ubuntu4.31.4.20.3+svn502-2ubuntu4.41.4.20.3+svn502-2ubuntu4.5
 None known
tgt
Ubuntu:Pro:18.04:LTS
 before 1:1.0.72-1ubuntu1+esm1, plus listed versions
1:1.0.71-1ubuntu11:1.0.71-1ubuntu21:1.0.72-1ubuntu1
1:1.0.72-1ubuntu1+esm1
tgt
Ubuntu:20.04:LTS
 before 1:1.0.79-2ubuntu1.1, plus listed versions
1:1.0.79-2ubuntu1
1:1.0.79-2ubuntu1.1
tgt
Ubuntu:Pro:22.04:LTS
 before 1:1.0.80-1ubuntu2+esm1, plus listed versions
1:1.0.80-1ubuntu11:1.0.80-1ubuntu2
1:1.0.80-1ubuntu2+esm1
tgt
Ubuntu:Pro:24.04:LTS
 before 1:1.0.85-1.1ubuntu6+esm1, plus listed versions
1:1.0.85-1ubuntu11:1.0.85-1.1ubuntu21:1.0.85-1.1ubuntu31:1.0.85-1.1ubuntu41:1.0.85-1.1ubuntu6
1:1.0.85-1.1ubuntu6+esm1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-45751 is a medium vulnerability (CVSS 5.9) in tgt, published September 6, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.55%, the 46th percentile. Fixed in tgt 1:1.0.85-1+deb12u1.

References

Show 14 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open