Technical Summary

The vulnerability exists in the Linux kernel's InfiniBand iSER driver (ib_isert.c), where the function isert_login_recv_done() calculates the login request payload length by subtracting ISER_HEADERS_LEN (76 bytes) from the received byte length without a lower bound check. If a remote iSER initiator sends a login Send work request with fewer than 76 bytes, this subtraction underflows, resulting in a negative signed integer. This negative value is then used as the length parameter in memcpy(), which is sign-extended to a very large size_t, causing a large out-of-bounds memory copy into an 8192-byte buffer, leading to a crash (denial of service). The login phase occurs before iSCSI authentication, so no credentials are needed to trigger this. The vulnerability affects numerous Linux kernel versions as listed. Ubuntu has released security advisories (USN-8629-1, USN-8630-1) addressing this and other kernel issues, recommending updates to fixed kernel versions.