CVE-2011-0001

Double free vulnerability in the iscsi_rx_handler function (usr/iscsi/iscsid.c) in the tgt daemon...

5.0 MediumFix available

CVE-2011-0001 is a medium vulnerability (CVSS 5.0) in Zaal Tgt, published March 15, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.11%, the 92nd percentile. Fixed in tgt 1:1.0.4-3.

What does this mean?

Severity: 5.0 MediumCVSS 2.0, NVD
Exploit chance: 5.11%EPSS, 92nd percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 1:1.0.4-3tgt +9 more

Description

Double free vulnerability in the iscsi_rx_handler function (usr/iscsi/iscsid.c) in the tgt daemon (tgtd) in Linux SCSI target framework (tgt) before 1.0.14, aka scsi-target-utils, allows remote attackers to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via unknown vectors related to a buffer overflow during iscsi login. NOTE: some of these details are obtained from third party information.

Exploit likelihood

5.11%Down 2.4 points since Feb 4, 2022

Affected products

zaal tgt

Affected packages

Affected packages
Package	Affected	Fixed
`tgt` Debian:12	before 1:1.0.4-3	1:1.0.4-3
`tgt` Debian:13	before 1:1.0.4-3	1:1.0.4-3
`tgt` Debian:14	before 1:1.0.4-3	1:1.0.4-3
`tgt` Debian:6.0	before 1:1.0.4-2squeeze1, plus listed versions 1:1.0.4-2	1:1.0.4-2squeeze1
`scsi-target-utils` Red Hat:rhel_cluster_storage:5	before 0:1.0.8-0.el5_6.1	0:1.0.8-0.el5_6.1
`scsi-target-utils-debuginfo` Red Hat:rhel_cluster_storage:5	before 0:1.0.8-0.el5_6.1	0:1.0.8-0.el5_6.1
`scsi-target-utils` Red Hat:enterprise_linux:6::server	before 0:1.0.4-3.el6_0.1	0:1.0.4-3.el6_0.1
`scsi-target-utils-debuginfo` Red Hat:enterprise_linux:6::server	before 0:1.0.4-3.el6_0.1	0:1.0.4-3.el6_0.1
`scsi-target-utils` Red Hat:enterprise_linux:6::workstation	before 0:1.0.4-3.el6_0.1	0:1.0.4-3.el6_0.1
`scsi-target-utils-debuginfo` Red Hat:enterprise_linux:6::workstation	before 0:1.0.4-3.el6_0.1	0:1.0.4-3.el6_0.1