{"id":"CVE-2024-45751","aliases":["DEBIAN-CVE-2024-45751","DLA-3976-1","EUVD-2024-41704","GHSA-cwq5-xwx7-85wm","MGASA-2024-0304","OESA-2024-2156","SUSE-SU-2025:02591-1","SUSE-SU-2025:02740-1","UBUNTU-CVE-2024-45751","USN-7024-1","USN-8325-1"],"status":"published","title":"tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand...","description":"tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-08","score":0.00547,"percentile":0.46089,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-338"],"published":"2024-09-06T00:00:00Z","modified":"2026-11-02T12:03:01Z","fixes":[{"ecosystem":"Debian:12","package":"tgt","fixed_in":["1:1.0.85-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tgt","fixed_in":["1:1.0.85-1.3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tgt","fixed_in":["1:1.0.85-1.3"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"tgt","fixed_in":["1:1.0.80-1+deb11u1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"tgt","fixed_in":["1.0.85-1.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"scsi-target-utils","fixed_in":["1.0.79-5.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"scsi-target-utils","fixed_in":["1.0.79-6.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"scsi-target-utils","fixed_in":["1.0.91-2.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"scsi-target-utils","fixed_in":["1.0.79-6.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"scsi-target-utils","fixed_in":["1.0.79-6.oe2203sp3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"tgt","fixed_in":["1.0.85-150600.10.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"tgt","fixed_in":["1.0.85-150600.10.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"tgt","fixed_in":["1.0.85-150600.10.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tgt","fixed_in":["1:1.0.43-0ubuntu4.1~14.04.3+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tgt","fixed_in":["1:1.0.63-1ubuntu1.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tgt","fixed_in":["1:1.0.72-1ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"tgt","fixed_in":["1:1.0.79-2ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"tgt","fixed_in":["1:1.0.80-1ubuntu2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"tgt","fixed_in":["1:1.0.85-1.1ubuntu6+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"tgt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.85-1+deb12u1"}]}],"versions":["1:1.0.85-1"]},{"source":"osv","ecosystem":"Debian:13","package":"tgt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.85-1.3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tgt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.85-1.3"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"tgt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.80-1+deb11u1"}]}],"versions":["1:1.0.80-1"]},{"source":"osv","ecosystem":"Mageia:9","package":"tgt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.85-1.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"scsi-target-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.79-5.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"scsi-target-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.79-6.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"scsi-target-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.91-2.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"scsi-target-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.79-6.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"scsi-target-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.79-6.oe2203sp3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"tgt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.85-150600.10.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"tgt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.85-150600.10.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"tgt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.85-150600.10.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tgt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.43-0ubuntu4.1~14.04.3+esm1"}]}],"versions":["1:1.0.38-0ubuntu1","1:1.0.41-0ubuntu1","1:1.0.43-0ubuntu1","1:1.0.43-0ubuntu2","1:1.0.43-0ubuntu4","1:1.0.43-0ubuntu4.1~14.04.1","1:1.0.43-0ubuntu4.1~14.04.2","1:1.0.43-0ubuntu4.1~14.04.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tgt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.63-1ubuntu1.1+esm1"}]}],"versions":["1:1.0.57-1ubuntu2","1:1.0.62-1ubuntu1","1:1.0.62-1ubuntu2","1:1.0.63-1ubuntu1","1:1.0.63-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"iscsitarget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.20.3+svn502-2ubuntu2","1.4.20.3+svn502-2ubuntu4","1.4.20.3+svn502-2ubuntu4.1","1.4.20.3+svn502-2ubuntu4.3","1.4.20.3+svn502-2ubuntu4.4","1.4.20.3+svn502-2ubuntu4.5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tgt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.72-1ubuntu1+esm1"}]}],"versions":["1:1.0.71-1ubuntu1","1:1.0.71-1ubuntu2","1:1.0.72-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tgt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.79-2ubuntu1.1"}]}],"versions":["1:1.0.79-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"tgt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.80-1ubuntu2+esm1"}]}],"versions":["1:1.0.80-1ubuntu1","1:1.0.80-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"tgt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.85-1.1ubuntu6+esm1"}]}],"versions":["1:1.0.85-1ubuntu1","1:1.0.85-1.1ubuntu2","1:1.0.85-1.1ubuntu3","1:1.0.85-1.1ubuntu4","1:1.0.85-1.1ubuntu6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tgt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.79-2ubuntu1.1"}]}],"versions":["1:1.0.79-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tgt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.43-0ubuntu4.1~14.04.3+esm1"}]}],"versions":["1:1.0.38-0ubuntu1","1:1.0.41-0ubuntu1","1:1.0.43-0ubuntu1","1:1.0.43-0ubuntu2","1:1.0.43-0ubuntu4","1:1.0.43-0ubuntu4.1~14.04.1","1:1.0.43-0ubuntu4.1~14.04.2","1:1.0.43-0ubuntu4.1~14.04.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tgt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.63-1ubuntu1.1+esm1"}]}],"versions":["1:1.0.57-1ubuntu2","1:1.0.62-1ubuntu1","1:1.0.62-1ubuntu2","1:1.0.63-1ubuntu1","1:1.0.63-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tgt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.72-1ubuntu1+esm1"}]}],"versions":["1:1.0.71-1ubuntu1","1:1.0.71-1ubuntu2","1:1.0.72-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"tgt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.80-1ubuntu2+esm1"}]}],"versions":["1:1.0.80-1ubuntu1","1:1.0.80-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"tgt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.85-1.1ubuntu6+esm1"}]}],"versions":["1:1.0.85-1ubuntu1","1:1.0.85-1.1ubuntu2","1:1.0.85-1.1ubuntu3","1:1.0.85-1.1ubuntu4","1:1.0.85-1.1ubuntu6"]}],"references":[{"url":"https://github.com/fujita/tgt/pull/67","tags":["fix","report"]},{"url":"https://github.com/fujita/tgt/compare/v1.0.92...v1.0.93","tags":["web","report"]},{"url":"https://www.openwall.com/lists/oss-security/2024/09/07/2","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/09/07/2","tags":["web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00033.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45751","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cwq5-xwx7-85wm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45751.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-45751","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0304.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33545","tags":["report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2156","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502591-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1230360","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45751","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502740-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-45751","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-45751","tags":["report"]},{"url":"https://github.com/fujita/tgt/commit/abd8e0d987ab56013d360077202bf2aca20a42dd","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7024-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8325-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-45751","description":"tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical.","status":"published","published":"2024-09-06T00:00:00Z","modified":"2024-11-30T12:04:02.08Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T14:34:07.831255Z"}],"euvd":[{"id":"EUVD-2024-41704","description":"tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical.","status":"published","published":"2024-09-06T00:00:00Z","modified":"2024-11-30T12:04:02Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:44.03074Z"}],"ghsa":[{"id":"GHSA-cwq5-xwx7-85wm","title":"tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand...","description":"tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical.","status":"published","published":"2024-09-06T06:31:41Z","modified":"2024-11-30T12:30:37Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T14:59:00.407025Z"}],"nvd":[{"id":"CVE-2024-45751","description":"tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical.","status":"published","published":"2024-09-06T05:15:13.84Z","modified":"2026-06-17T07:54:44.727Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T14:10:24.514378Z"}],"osv":[{"id":"CVE-2024-45751","description":"tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical.","status":"published","published":"2024-09-06T00:00:00Z","modified":"2026-10-28T02:30:55.861361865Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:42.790566Z"},{"id":"DEBIAN-CVE-2024-45751","description":"tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical.","status":"published","published":"2024-09-06T05:15:13.84Z","modified":"2026-11-02T12:03:01.745744349Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:43.473331Z"},{"id":"OESA-2024-2156","title":"scsi-target-utils security update","description":"The SCSI target package contains the daemon and tools to setup a SCSI targets. Currently, software iSCSI targets are supported.\n\nSecurity Fix(es):\n\ntgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical.(CVE-2024-45751)","status":"published","published":"2024-09-20T11:07:37Z","modified":"2026-08-18T01:17:32.926867969Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"UBUNTU-CVE-2024-45751","description":"tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical.","status":"published","published":"2024-09-06T05:15:00Z","modified":"2026-05-27T18:14:18.437612603Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:02.636559Z"},{"id":"DLA-3976-1","title":"tgt - security update","status":"published","published":"2024-11-30T00:00:00Z","modified":"2026-03-09T01:21:25.560757Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2024-0304","title":"Updated tgt packages fix security vulnerability","description":"tgt (aka Linux target framework) before 1.0.93 attempts to achieve\nentropy by calling rand without srand. The PRNG seed is always 1, and\nthus the sequence of challenges is always identical. (CVE-2024-45751)\n","status":"published","published":"2024-09-16T17:44:44Z","modified":"2026-04-16T04:41:55.816346612Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"SUSE-SU-2025:02591-1","title":"Security update for tgt","description":"This update for tgt fixes the following issues:\n\n- CVE-2024-45751: Fixed CHAP authentication bypass in user-space Linux target framework (bsc#1230360)\n","status":"published","published":"2025-08-01T14:08:41Z","modified":"2026-03-23T04:47:48.186246Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02740-1","title":"Security update for tgt","description":"This update for tgt fixes the following issues:\n\n- CVE-2024-45751: Fixed CHAP authentication bypass in user-space Linux target framework (bsc#1230360)\n","status":"published","published":"2025-08-08T09:11:54Z","modified":"2026-02-04T04:32:44.803731Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"USN-7024-1","title":"tgt vulnerability","description":"It was discovered that tgt attempts to achieve entropy\nby calling rand without srand. The PRNG seed is always 1,\nand thus the sequence of challenges is always identical.\n","status":"published","published":"2024-09-19T16:11:22Z","modified":"2026-04-27T17:30:13.19919Z","updated_at":"2026-11-02T16:58:18.876384Z"},{"id":"USN-8325-1","title":"tgt vulnerability","description":"It was discovered that tgt incorrectly tried to achieve entropy by calling\nrand without srand. An attacker could possibly use this issue to make tgt\ngenerate an identical sequence of challenges, resulting in authentication\nbypass.","status":"published","published":"2026-05-27T15:01:27Z","modified":"2026-05-27T18:14:18.717925918Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}